diff --git a/contentctl.yml b/contentctl.yml index 687d74f8bf..2d8581418c 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -188,6 +188,12 @@ apps: version: 1.9.2 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz +- uid: 6853 + title: Splunk Add-on for Admon Enrichment + appid: SA-admon + version: 1.1.0 + description: description of app + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_112.tgz - uid: 5082 title: CrowdStrike Falcon Event Streams Technical Add-On appid: TA-crowdstrike-falcon-event-streams diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml new file mode 100644 index 0000000000..b7f6bee2cc --- /dev/null +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -0,0 +1,84 @@ +name: Windows AD Dangerous Deny ACL Modification +id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 +version: 1 +date: '2023-11-21' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. +search: >- + `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) + | `windows_ad_dangerous_deny_acl_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. +references: +- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 +- https://www.youtube.com/watch?v=_nGpZ1ydzS8 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml new file mode 100644 index 0000000000..ae125e8c7d --- /dev/null +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -0,0 +1,88 @@ +name: Windows AD Dangerous Group ACL Modification +id: 59b0fc85-7a0d-4585-97ec-06a382801990 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: >- + This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", + "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". + Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=group + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_group_acl_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml new file mode 100644 index 0000000000..8cfdbceb4c --- /dev/null +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -0,0 +1,88 @@ +name: Windows AD Dangerous User ACL Modification +id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 +version: 1 +date: '2023-11-15' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: >- + This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", + "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". + Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=user + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_user_acl_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml new file mode 100644 index 0000000000..07654823a8 --- /dev/null +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -0,0 +1,83 @@ +name: Windows AD DCShadow Privileges ACL Addition +id: ae915743-1aa8-4a94-975c-8062ebc8b723 +version: 1 +date: '2023-11-10' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") + | `windows_ad_dcshadow_privileges_acl_addition_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://www.labofapenetrationtester.com/2018/04/dcshadow.html +- https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1 +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. + mitre_attack_id: + - T1484 + - T1207 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml new file mode 100644 index 0000000000..3d117d3d82 --- /dev/null +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -0,0 +1,84 @@ +name: Windows AD Domain Root ACL Deletion +id: 3cb56e57-5642-4638-907f-8dfde9afb889 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand old_values + | where NOT old_values IN (new_values) + | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | `windows_ad_domain_root_acl_deletion_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml new file mode 100644 index 0000000000..b6e2a09041 --- /dev/null +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -0,0 +1,84 @@ +name: Windows AD Domain Root ACL Modification +id: 4981e2db-1372-440d-816e-3e7e2ed74433 +version: 1 +date: '2023-11-11' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | `windows_ad_domain_root_acl_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml new file mode 100644 index 0000000000..7caec33736 --- /dev/null +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -0,0 +1,67 @@ +name: Windows AD GPO Deleted +id: 0d41772b-35ab-4e1c-a2ba-d0b455481aee +version: 1 +date: '2023-11-24' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN) + | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId + | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" + | rex field=new_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" + | mvexpand old_dn + | where NOT old_dn IN (new_dn) + | eval ObjectDN=upper(old_dn) + | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] + | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId + | `windows_ad_gpo_deleted_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: GPO $policyName$ was deleted by $src_user$ + mitre_attack_id: + - T1562.001 + - T1484.001 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml new file mode 100644 index 0000000000..d7b122d2bd --- /dev/null +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -0,0 +1,62 @@ +name: Windows AD GPO Disabled +id: 72793bc0-c0cd-400e-9e60-fdf36f278917 +version: 1 +date: '2023-11-24' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console. +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0 + | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) + | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] + | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId + | `windows_ad_gpo_disabled_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $src_user$ has disabled GPO $policyName$ + mitre_attack_id: + - T1562.001 + - T1484.001 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml new file mode 100644 index 0000000000..7404ec85a7 --- /dev/null +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -0,0 +1,74 @@ +name: Windows AD GPO New CSE Addition +id: 700c11d1-da09-47b2-81aa-358c143c7986 +version: 1 +date: '2023-11-22' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console. +search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | mvexpand new_values + | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) + | join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] + | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN + | `windows_ad_gpo_new_cse_addition_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. +known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection. +references: +- https://wald0.com/?p=179 +- https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +- https://github.com/FSecureLABS/SharpGPOAbuse +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ + mitre_attack_id: + - T1484 + - T1484.001 + - T1222 + - T1222.001 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml new file mode 100644 index 0000000000..edc4f97dc3 --- /dev/null +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -0,0 +1,83 @@ +name: Windows AD Hidden OU Creation +id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 +version: 1 +date: '2023-11-16' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) + | `windows_ad_hidden_ou_creation_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. +references: +- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has hidden the contents of OU $ObjectDN$ from $user$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml new file mode 100644 index 0000000000..3aca7ad031 --- /dev/null +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -0,0 +1,78 @@ +name: Windows AD Object Owner Updated +id: 4af01f6b-d8d4-4f96-8635-758a01557130 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object. +search: ' `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName + | rex field=old_value "O:(?P.*?)G:" + | rex field=new_value "O:(?P.*?)G:" + | where old_owner!=new_owner + ``` optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group + ``` + | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) + | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName + | `windows_ad_object_owner_updated_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has made $user$ the owner of AD object $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml new file mode 100644 index 0000000000..82aaff088d --- /dev/null +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -0,0 +1,54 @@ +name: Windows AD Privileged Group Modification +id: 187bf937-c436-4c65-bbcb-7539ffe02da1 +version: 1 +date: '2023-09-27' +author: Dean Luxton +status: experimental +type: TTP +data_source: +- XmlWinEventLog:Security +description: Detect users added to privileged AD Groups. +search: '`wineventlog_security` EventCode IN (4728) + | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user + | lookup admon_groups_def cn as Group_Name OUTPUT category + | where category="privileged" | `windows_ad_privileged_group_modification_filter`' +how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. + See splunkbase app listed in the references for further details. +known_false_positives: None +references: +- https://splunkbase.splunk.com/app/6853 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 50 + message: $user$ was added to privileged AD Group $Group_Name$ by $src_user$ + mitre_attack_id: + - T1098 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 50 + required_fields: + - EventCode + - user + - src_user + - signature + - Group_Name + - dest + security_domain: identity + manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml new file mode 100644 index 0000000000..25e3e509fa --- /dev/null +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -0,0 +1,79 @@ +name: Windows AD Self DACL Assignment +id: 16132445-da9f-4d03-ad44-56d717dcd67d +version: 1 +date: '2023-12-18' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Detect when a user creates a new DACL in AD for their own AD object. +search: >- + `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | rex field=user "\\\(?P.*?)$" + | where lower(src_user)=lower(nt_user) + | `windows_ad_self_dacl_assignment_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 80 + message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$ + mitre_attack_id: + - T1484 + - T1098 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 80 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml new file mode 100644 index 0000000000..f006dae853 --- /dev/null +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -0,0 +1,73 @@ +name: Windows AD Suspicious Attribute Modification +id: 5682052e-ce55-4f9f-8d28-59191420b7e0 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: >- + This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". + Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert. +search: >- + `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674 + ```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied``` + | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName + | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime + | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] + | stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by TargetLogonId + | rex field=ObjectDN "^CN=(?P.*?),[A-Z]{2}\=" + | eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null) + | fields - cn + | `windows_ad_suspicious_attribute_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes. +known_false_positives: If key credentials are regularly assigned to users, these events will need to be tuned out. +references: +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$ + mitre_attack_id: + - T1550 + - T1222 + - T1222.001 + observable: + - name: src_user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml new file mode 100644 index 0000000000..7abeb092eb --- /dev/null +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -0,0 +1,89 @@ +name: Windows AD Suspicious GPO Modification +id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf +version: 1 +date: '2023-12-19' +author: Dean Luxton +status: experimental +type: TTP +data_source: +- Windows Security 5136 +- Windows Security 5145 +description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. + Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs. +search: >- + `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 + | rex field=AccessList max_match=0 "(?P%%\d+)" + | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc + | rex field=RelativeTargetName "Policies\\\(?P{.*?})\\\(?P\w+?)\\\(\w+)\\\(?P\w+)\\\(?P\w+\.\w+)$" + | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder) + | appendpipe + [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | mvexpand new_values + | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) + | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | fields - ObjectDN] + | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid + | mvexpand folder + | where NOT folder IN (newPolicy) + | `windows_ad_suspicious_gpo_modification_filter` +how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. + The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2. +known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk. +references: +- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122 +- https://github.com/X-C3LL/GPOwned +- https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/ +- https://wald0.com/?p=179 +- https://github.com/FSecureLABS/SharpGPOAbuse +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 80 + impact: 100 + message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$ + mitre_attack_id: + - T1484 + - T1484.001 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 80 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index a97e7be545..b4acf713d2 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Global Administrator Role Assigned id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c -version: 6 -date: '2024-07-02' -author: Gowthamaraj Rajendran, Mauricio Velazco, Dean Luxton, Splunk +version: 5 +date: '2024-05-29' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects the assignment of the Azure AD Global @@ -15,14 +15,11 @@ description: The following analytic detects the assignment of the Azure AD Globa posing a severe security risk. data_source: - Azure Active Directory Add member to role -search: '`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\"" - | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName - | eval initiatedBy = coalesce(userPrincipalName,src_user) - | eval user = coalesce(user,mvfilter(displayName!="null")) - | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `azure_ad_global_administrator_role_assigned_filter`' +search: '`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global + Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName + as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime values(user) + as user by initiatedBy, result, operationName | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index 9d7a02ef8f..841b4c60f5 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 4 -date: '2024-07-02' -author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk +version: 3 +date: '2024-05-29' +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic detects the assignment of privileged Azure Active @@ -14,10 +14,8 @@ description: The following analytic detects the assignment of privileged Azure A over the Azure AD infrastructure. data_source: - Azure Active Directory Add member to role -search: ' `azure_monitor_aad` "operationName"="Add member to role" - | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName - | eval initiatedBy = coalesce(userPrincipalName,src_user) - | eval user = coalesce(user,mvfilter(displayName!="null")) +search: ' `azure_monitor_aad` "operationName"="Add member to role" | rename properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue as roles | eval role=mvindex(roles,1) | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName, role diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index 6ba133cdc3..99e48bd36c 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -1,8 +1,8 @@ name: Azure AD Service Principal New Client Credentials id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a -version: 4 -date: '2024-07-02' -author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk +version: 3 +date: '2024-05-11' +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic detects the addition of new credentials to Service @@ -15,21 +15,11 @@ description: The following analytic detects the addition of new credentials to S access and control over the Azure environment. data_source: - Azure Active Directory -search: ' `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates and secrets management*" - | rename properties.* as * - | rename targetResources{}.* as * - | rename modifiedProperties{}.* as * - | eval src_user=coalesce(user,identity), newValue=mvfilter(newValue!="\"KeyDescription\"") - | stats count min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName values(src_ip) as src_ip values(eval(mvfilter(oldValue!="null"))) as oldValue by src_user, object, newValue - | spath input=oldValue output=oldValues path={} - | spath input=newValue output=newValues path={} - | mvexpand newValues - | where NOT newValues IN (oldValues) - | fields - newValue, oldValue, oldValues - | rename newValues as newValue - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `azure_ad_service_principal_new_client_credentials_filter`' +search: ' `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates + and secrets management " | rename properties.* as * | rename targetResources{}.* + as * | stats count min(_time) as firstTime max(_time) as lastTime values(displayName) + as displayName by user, modifiedProperties{}.newValue, src_ip | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `azure_ad_service_principal_new_client_credentials_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. @@ -52,16 +42,12 @@ tags: asset_type: Azure Active Directory confidence: 50 impact: 70 - message: New Service Principal credentials were added to $object$ by $src_user$ + message: New credentials added for Service Principal by $user$ mitre_attack_id: - T1098 - T1098.001 observable: - - name: src_user - type: User - role: - - Victim - - name: object + - name: user type: User role: - Victim diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 7726935583..3713d9963f 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -1,7 +1,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d -version: 5 -date: '2024-07-02' +version: 4 +date: '2024-05-15' author: David Dorsey, Splunk status: production type: TTP @@ -10,11 +10,10 @@ description: |- data_source: - Windows Event Log Security 4732 - Windows Event Log Security 4720 -search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators) -| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest -| where evCount=2 -| fields - evCount, duration -| `detect_new_local_admin_account_filter`' +search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) + | transaction src_user connected=false maxspan=180m | rename src_user as user | + stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`' how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best @@ -40,10 +39,6 @@ tags: type: User role: - Victim - - name: src_user - type: User - role: - - Victim - name: dest type: Hostname role: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 7b99ce810a..43385ce72c 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -1,8 +1,8 @@ name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl id: 0cb847ee-9423-11ec-b2df-acde48001122 -version: 3 -date: '2024-07-02' -author: Mauricio Velazco, Dean Luxton, Splunk +version: 2 +date: '2024-05-24' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects when the Kerberos Pre-Authentication flag @@ -15,10 +15,9 @@ description: The following analytic detects when the Kerberos Pre-Authentication of sensitive information. data_source: - Windows Event Log Security 4738 -search: '`wineventlog_security` EventCode=4738 (UserAccountControl="%%2096" OR MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*") - | eval MSADChangedAttributes="''Don''t Require Preauth'' - Enabled" - | table _time, source, EventCode, src_user, src_user_category, user, user_category, MSADChangedAttributes - | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' +search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require + Preauth'' - Enabled*" |rename Account_Name as user | table EventCode, user, dest, + Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index b78653d7b2..f4d2072016 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,8 +1,8 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 2 -date: '2024-05-13' -author: Mauricio Velazco, Splunk +version: 3 +date: '2024-07-02' +author: Mauricio Velazco, Dean Luxton, Splunk type: TTP status: production data_source: @@ -15,10 +15,29 @@ description: The following analytic detects modifications to the Access Control can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. -search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor - OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" | rex field=AttributeValue - max_match=10000 "A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)" - | stats values(added_user_sid) by _time, Computer, SubjectUserName, ObjectDN | `windows_ad_adminsdholder_acl_modified_filter`' +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_adminsdholder_acl_modified_filter` how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created @@ -33,24 +52,25 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 - https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks asset_type: Endpoint confidence: 70 impact: 80 - message: The AdminSDHolder domain object has been modified on $Computer$ by $SubjectUserName$ + message: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$ mitre_attack_id: - T1546 observable: - - name: SubjectUserName + - name: user + type: User + role: + - Victim + - name: src_user type: User role: - Attacker - - name: Computer - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 7ffe52a19a..a7e217a4ce 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,11 +1,12 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 2 -date: "2024-05-16" +version: 4 +date: "2024-08-08" author: Dean Luxton type: TTP -status: experimental -data_source: [] +status: production +data_source: +- Windows Security 5136 description: The following analytic detects the addition of permissions required for a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from @@ -14,14 +15,29 @@ description: The following analytic detects the addition of permissions required attack, which can be used to replicate AD objects and exfiltrate sensitive data. If confirmed malicious, an attacker could gain extensive access to Active Directory, leading to severe data breaches and privilege escalation. -search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"| - table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| - mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), - fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")| - where minDCSyncPermissions="true" | lookup identity_lookup_expanded objectSid - as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid - as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid - minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2") + | `windows_ad_domain_replication_acl_addition_filter` how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` @@ -38,6 +54,7 @@ known_false_positives: When there is a change to nTSecurityDescriptor, Windows l references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks @@ -56,17 +73,13 @@ tags: type: User role: - Victim - - name: dest - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - - dest + - OperationType - src_user - AttributeLDAPDisplayName - AttributeValue diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 3b998d3d3b..09293b4370 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -41,7 +41,6 @@ references: - https://adsecurity.org/?p=1729 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml -- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index d1d6135208..2edcc972e0 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -45,7 +45,6 @@ references: - https://adsecurity.org/?p=1729 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml -- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_with_net.yml index 057b77623e..638661e1ca 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/endpoint/windows_network_share_interaction_with_net.yml @@ -12,7 +12,7 @@ description: This analytic detects network share discovery and collection activi which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s" diff --git a/lookups/ace_access_rights_lookup.csv b/lookups/ace_access_rights_lookup.csv new file mode 100644 index 0000000000..734b14fee2 --- /dev/null +++ b/lookups/ace_access_rights_lookup.csv @@ -0,0 +1,14 @@ +access_rights_string,access_rights_value +RC,Read permissions +SD,Delete +WD,Modify permissions +WO,Modify owner +RP,Read all properties +WP,Write all properties +CC,Create all child objects +DC,Delete all child objects +LC,List contents +SW,All validated writes +LO,List objects +DT,Delete subtree +CR,All extended rights \ No newline at end of file diff --git a/lookups/ace_access_rights_lookup.yml b/lookups/ace_access_rights_lookup.yml new file mode 100644 index 0000000000..eb19f3befa --- /dev/null +++ b/lookups/ace_access_rights_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace access rights strings +filename: ace_access_rights_lookup.csv +name: ace_access_rights_lookup \ No newline at end of file diff --git a/lookups/ace_flag_lookup.csv b/lookups/ace_flag_lookup.csv new file mode 100644 index 0000000000..e2b08679eb --- /dev/null +++ b/lookups/ace_flag_lookup.csv @@ -0,0 +1,10 @@ +flag_string,flag_value +CI,Container inherit +OI,Object inherit +NP,No propagate +IO,Inherit only +ID,Inherited +SA,Audit success +FA,Audit failure +TP,Trust protected filter +CR,Critical \ No newline at end of file diff --git a/lookups/ace_flag_lookup.yml b/lookups/ace_flag_lookup.yml new file mode 100644 index 0000000000..04c9c22d75 --- /dev/null +++ b/lookups/ace_flag_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace flags strings +filename: ace_flag_lookup.csv +name: ace_flag_lookup \ No newline at end of file diff --git a/lookups/ace_type_lookup.csv b/lookups/ace_type_lookup.csv new file mode 100644 index 0000000000..8323d6bd30 --- /dev/null +++ b/lookups/ace_type_lookup.csv @@ -0,0 +1,18 @@ +ace_type_string,ace_type_value +A,Access allowed +D,Access denied +OA,Object access allowed +OD,Object access denied +AU,Audit +AL,Alarm +OU,Object audit +OL,Object alarm +ML,Mandatory label +XA,Callback access allowed +XD,Callback access denied +RA,Resource attribute +SP,Scoped policy ID +XU,Callback audit +ZA,Callback object access allowed +TL,Process trust label +FL,Access filter \ No newline at end of file diff --git a/lookups/ace_type_lookup.yml b/lookups/ace_type_lookup.yml new file mode 100644 index 0000000000..ce9a833964 --- /dev/null +++ b/lookups/ace_type_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace type strings +filename: ace_type_lookup.csv +name: ace_type_lookup \ No newline at end of file diff --git a/lookups/builtin_groups_lookup.csv b/lookups/builtin_groups_lookup.csv new file mode 100644 index 0000000000..c190d96d88 --- /dev/null +++ b/lookups/builtin_groups_lookup.csv @@ -0,0 +1,39 @@ +builtin_group_string,builtin_group_name +AO,Account operators +RU,Alias to allow previous Windows 2000 +AN,Anonymous logon +AU,Authenticated users +BA,Built-in administrators +BG,Built-in guests +BO,Backup operators +BU,Built-in users +CA,Certificate server administrators +CG,Creator group +CO,Creator owner +DA,Domain administrators +DC,Domain computers +DD,Domain controllers +DG,Domain guests +DU,Domain users +EA,Enterprise administrators +ED,Enterprise domain controllers +WD,Everyone +PA,Group Policy administrators +IU,Interactively logged-on user +LA,Local administrator +LG,Local guest +LS,Local service account +SY,Local system +NU,Network sign-in user +NO,Network configuration operators +NS,Network service account +PO,Printer operators +PS,Personal self +PU,Power users +RS,RAS servers group +RD,Terminal server users +RE,Replicator +RC,Restricted code +SA,Schema administrators +SO,Server operators +SU,Service sign-in user \ No newline at end of file diff --git a/lookups/builtin_groups_lookup.yml b/lookups/builtin_groups_lookup.yml new file mode 100644 index 0000000000..cc4959d3c4 --- /dev/null +++ b/lookups/builtin_groups_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for builtin AD group strings +filename: builtin_groups_lookup.csv +name: builtin_groups_lookup \ No newline at end of file diff --git a/lookups/msad_guid_lookup.csv b/lookups/msad_guid_lookup.csv new file mode 100644 index 0000000000..005354204b --- /dev/null +++ b/lookups/msad_guid_lookup.csv @@ -0,0 +1,1678 @@ +displayName,guid,type +"Domain Administer Server","ab721a52-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Change Password","ab721a53-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Reset Password","00299570-246d-11d0-a768-00aa006e0529","Extended Rights" +"Send As","ab721a54-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Receive As","ab721a56-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Send To","ab721a55-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Domain Password & Lockout Policies","c7407360-20bf-11d0-a768-00aa006e0529","Extended Rights" +"General Information","59ba2f42-79a2-11d0-9020-00c04fc2d3cf","Extended Rights" +"Account Restrictions","4c164200-20c0-11d0-a768-00aa006e0529","Extended Rights" +"Logon Information","5f202010-79a5-11d0-9020-00c04fc2d4cf","Extended Rights" +"Group Membership","bc0ac240-79a9-11d0-9020-00c04fc2d4cf","Extended Rights" +"Open Address List","a1990816-4298-11d1-ade2-00c04fd8d5cd","Extended Rights" +"Personal Information","77b5b886-944a-11d1-aebd-0000f80367c1","Extended Rights" +"Phone and Mail Options","e45795b2-9455-11d1-aebd-0000f80367c1","Extended Rights" +"Web Information","e45795b3-9455-11d1-aebd-0000f80367c1","Extended Rights" +"Replicating Directory Changes","1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Replication Synchronization","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Manage Replication Topology","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Change Schema Master","e12b56b6-0a95-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Change Rid Master","d58d5f36-0a98-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Do Garbage Collection","fec364e0-0a98-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Recalculate Hierarchy","0bc1554e-0a99-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Allocate Rids","1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Change PDC","bae50096-4752-11d1-9052-00c04fc2d4cf","Extended Rights" +"Add GUID","440820ad-65b4-11d1-a3da-0000f875ae0d","Extended Rights" +"Change Domain Master","014bf69c-7b3b-11d1-85f6-08002be74fab","Extended Rights" +"Public Information","e48d0154-bcf8-11d1-8702-00c04fb96050","Extended Rights" +"Receive Dead Letter","4b6e08c0-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Peek Dead Letter","4b6e08c1-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Receive Computer Journal","4b6e08c2-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Peek Computer Journal","4b6e08c3-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Receive Message","06bd3200-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Peek Message","06bd3201-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Send Message","06bd3202-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Receive Journal","06bd3203-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Open Connector Queue","b4e60130-df3f-11d1-9c86-006008764d0e","Extended Rights" +"Apply Group Policy","edacfd8f-ffb3-11d1-b41d-00a0c968f939","Extended Rights" +"Remote Access Information","037088f8-0ae1-11d2-b422-00a0c968f939","Extended Rights" +"Add/Remove Replica In Domain","9923a32a-3607-11d2-b9be-0000f87a36b2","Extended Rights" +"Change Infrastructure Master","cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd","Extended Rights" +"Update Schema Cache","be2bb760-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +"Recalculate Security Inheritance","62dd28a8-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +"Check Stale Phantoms","69ae6200-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +Enroll,"0e10c968-78fb-11d2-90d4-00c04f79dc55","Extended Rights" +"Add/Remove self as member","bf9679c0-0de6-11d0-a285-00aa003049e2","Extended Rights" +"Validated write to DNS host name","72e39547-7b18-11d1-adef-00c04fd8d5cd","Extended Rights" +"Validated write to service principal name","f3a64788-5306-11d1-a9c5-0000f80367c1","Extended Rights" +"Generate Resultant Set of Policy (Planning)","b7b1b3dd-ab09-4242-9e30-9980e5d322f7","Extended Rights" +"Refresh Group Cache for Logons","9432c620-033c-4db7-8b58-14ef6d0bf477","Extended Rights" +"Enumerate Entire SAM Domain","91d67418-0135-4acc-8d79-c08e857cfbec","Extended Rights" +"Generate Resultant Set of Policy (Logging)","b7b1b3de-ab09-4242-9e30-9980e5d322f7","Extended Rights" +"Other Domain Parameters (for use by SAM)","b8119fd0-04f6-4762-ab7a-4986c76b3f9a","Extended Rights" +"DNS Host Name Attributes","72e39547-7b18-11d1-adef-00c04fd8d5cd","Extended Rights" +"Create Inbound Forest Trust","e2a36dc9-ae17-47c3-b58b-be34c55ba633","Extended Rights" +"Replicating Directory Changes All","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Migrate SID History","ba33815a-4f93-4c76-87f3-57574bff8109","Extended Rights" +"Reanimate Tombstones","45ec5156-db7e-47bb-b53f-dbeb2d03c40f","Extended Rights" +"Allowed to Authenticate","68b1d179-0d15-4d4f-ab71-46152e79a7bc","Extended Rights" +"Execute Forest Update Script","2f16c4a5-b98e-432c-952a-cb388ba33f2e","Extended Rights" +"Monitor Active Directory Replication","f98340fb-7c5b-4cdb-a00b-2ebdfa115a96","Extended Rights" +"Update Password Not Required Bit","280f369c-67c7-438e-ae98-1d46f3c6f541","Extended Rights" +"Unexpire Password","ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501","Extended Rights" +"Enable Per User Reversibly Encrypted Password","05c74c5e-4deb-43b4-bd9f-86664c2a7fd5","Extended Rights" +"Query Self Quota","4ecc03fe-ffc0-4947-b630-eb672a8a9dbc","Extended Rights" +"Private Information","91e647de-d96f-4b70-9557-d63ff4f3ccd8","Extended Rights" +"Read Only Replication Secret Synchronization","1131f6ae-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"MS-TS-GatewayAccess","ffa6f046-ca4b-4feb-b40d-04dfee722543","Extended Rights" +"Terminal Server License Server","5805bc62-bdc9-4428-a5e2-856a0f4c185e","Extended Rights" +"Reload SSL/TLS Certificate","1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8","Extended Rights" +"Replicating Directory Changes In Filtered Set","89e95b76-444d-4c62-991a-0facbeda640c","Extended Rights" +"Run Protect Admin Groups Task","7726b9d5-a4b4-4288-a6b2-dce952e80a7f","Extended Rights" +"Manage Optional Features for Active Directory","7c0e2a7c-a419-48e4-a995-10180aad54dd","Extended Rights" +"Allow a DC to create a clone of itself","3e0f7e18-2c7a-4c10-ba82-4d926db99a3e","Extended Rights" +"Validated write to MS DS behavior version","d31a8757-2447-4545-8081-3bb610cacbf2","Extended Rights" +"Validated write to MS DS Additional DNS Host Name","80863791-dbe9-4eb8-837e-7f0ab55d9ac7","Extended Rights" +AutoEnrollment,"a05b8cc2-17bc-4802-a710-e7c15ab866a2","Extended Rights" +"Set Owner of an object during creation.","4125c71f-7fac-4ff0-bcb7-f09a41325286","Extended Rights" +"Bypass the quota restrictions during creation.","88a9933e-e5c8-4f2a-9dd7-2527416b8092","Extended Rights" +"Read secret attributes of objects in a Partition.","084c93a2-620d-4879-a836-f0ae47de0e89","Extended Rights" +"Write secret attributes of objects in a Partition.","94825a8d-b171-4116-8146-1e34d8f54401","Extended Rights" +"Validated write to computer attributes.","9b026da6-0d3c-465c-8bee-5199d7165cba","Extended Rights" +accountExpires,"bf967915-0de6-11d0-a285-00aa003049e2","AD Attribute" +accountNameHistory,"031952ec-3b72-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSAggregateTokenRatePerUser,"7f56127d-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSAllocableRSVPBandwidth,"7f561283-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSCacheTimeout,"1cb355a1-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDirection,"7f56127a-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSDSBMDeadTime,"1cb355a0-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDSBMPriority,"1cb3559e-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDSBMRefresh,"1cb3559f-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSEnableACSService,"7f561287-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSEnableRSVPAccounting,"f072230e-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSEnableRSVPMessageLogging,"7f561285-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSEventLogLevel,"7f561286-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSIdentityName,"dab029b6-ddf7-11d1-90a5-00c04fd91ab1","AD Attribute" +aCSMaxAggregatePeakRatePerUser,"f072230c-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxDurationPerFlow,"7f56127e-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxNoOfAccountFiles,"f0722310-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxNoOfLogFiles,"1cb3559c-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSMaxPeakBandwidth,"7f561284-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxPeakBandwidthPerFlow,"7f56127c-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxSizeOfRSVPAccountFile,"f0722311-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxSizeOfRSVPLogFile,"1cb3559d-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSMaxTokenBucketPerFlow,"81f6e0df-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMaxTokenRatePerFlow,"7f56127b-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaximumSDUSize,"87a2d8f9-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumDelayVariation,"9c65329b-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumLatency,"9517fefb-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumPolicedSize,"8d0e7195-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedMaxSDUSize,"aec2cfe3-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedMinPolicedSize,"b6873917-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedPeakRate,"a331a73f-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedTokenSize,"a916d7c9-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedTxLimit,"1cb355a2-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSNonReservedTxSize,"f072230d-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSPermissionBits,"7f561282-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSPolicyName,"1cb3559a-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSPriority,"7f561281-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSRSVPAccountFilesLocation,"f072230f-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSRSVPLogFilesLocation,"1cb3559b-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSServiceType,"7f56127f-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSTimeOfDay,"7f561279-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSTotalNoOfFlows,"7f561280-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSServerList,"7cbd59a5-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +notes,"6d05fb41-246b-11d0-a9c8-00aa006c33ed","AD Attribute" +additionalTrustedServiceNames,"032160be-9824-11d1-aec0-0000f80367c1","AD Attribute" +streetAddress,"f0f8ff84-1191-11d0-a060-00aa006c33ed","AD Attribute" +addressBookRoots,"f70b6e48-06f4-11d2-aa53-00c04fd7d83a","AD Attribute" +addressEntryDisplayTable,"5fd42461-1262-11d0-a060-00aa006c33ed","AD Attribute" +addressEntryDisplayTableMSDOS,"5fd42462-1262-11d0-a060-00aa006c33ed","AD Attribute" +homePostalAddress,"16775781-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +addressSyntax,"5fd42463-1262-11d0-a060-00aa006c33ed","AD Attribute" +addressType,"5fd42464-1262-11d0-a060-00aa006c33ed","AD Attribute" +adminContextMenu,"553fd038-f32e-11d0-b0bc-00c04fd8dca6","AD Attribute" +adminCount,"bf967918-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminDescription,"bf967919-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminDisplayName,"bf96791a-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminMultiselectPropertyPages,"18f9b67d-5ac6-4b3b-97db-d0a406afb7ba","AD Attribute" +adminPropertyPages,"52458038-ca6a-11d0-afff-0000f80367c1","AD Attribute" +allowedAttributes,"9a7ad940-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedAttributesEffective,"9a7ad941-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedChildClasses,"9a7ad942-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedChildClassesEffective,"9a7ad943-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +altSecurityIdentities,"00fbf30c-91fe-11d1-aebc-0000f80367c1","AD Attribute" +aNR,"45b01500-c419-11d1-bbc9-0080c76670c0","AD Attribute" +appSchemaVersion,"96a7dd65-9118-11d1-aebc-0000f80367c1","AD Attribute" +applicationName,"dd712226-10e4-11d0-a05f-00aa006c33ed","AD Attribute" +appliesTo,"8297931d-86d3-11d0-afda-00c04fd930c9","AD Attribute" +assetNumber,"ba305f75-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +assistant,"0296c11c-40da-11d1-a9c0-0000f80367c1","AD Attribute" +assocNTAccount,"398f63c0-ca60-11d1-bbd1-0000f81f10c0","AD Attribute" +associatedDomain,"3320fc38-c379-4c17-a510-1bdf6133c5da","AD Attribute" +associatedName,"f7fbfc45-85ab-42a4-a435-780e62f7858b","AD Attribute" +attributeCertificateAttribute,"fa4693bb-7bc2-4cb9-81a8-c99c43b7905e","AD Attribute" +attributeDisplayNames,"cb843f80-48d9-11d1-a9c3-0000f80367c1","AD Attribute" +attributeID,"bf967922-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeSecurityGUID,"bf967924-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeSyntax,"bf967925-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeTypes,"9a7ad944-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +audio,"d0e1d224-e1a0-42ce-a2da-793ba5244f35","AD Attribute" +auditingPolicy,"6da8a4fe-0e52-11d0-a286-00aa003049e2","AD Attribute" +authenticationOptions,"bf967928-0de6-11d0-a285-00aa003049e2","AD Attribute" +authorityRevocationList,"1677578d-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +auxiliaryClass,"bf96792c-0de6-11d0-a285-00aa003049e2","AD Attribute" +badPasswordTime,"bf96792d-0de6-11d0-a285-00aa003049e2","AD Attribute" +badPwdCount,"bf96792e-0de6-11d0-a285-00aa003049e2","AD Attribute" +birthLocation,"1f0075f9-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +bridgeheadServerListBL,"d50c2cdb-8951-11d1-aebc-0000f80367c1","AD Attribute" +bridgeheadTransportList,"d50c2cda-8951-11d1-aebc-0000f80367c1","AD Attribute" +buildingName,"f87fa54b-b2c5-4fd7-88c0-daccb21d93c5","AD Attribute" +builtinCreationTime,"bf96792f-0de6-11d0-a285-00aa003049e2","AD Attribute" +builtinModifiedCount,"bf967930-0de6-11d0-a285-00aa003049e2","AD Attribute" +businessCategory,"bf967931-0de6-11d0-a285-00aa003049e2","AD Attribute" +bytesPerMinute,"ba305f76-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +cACertificate,"bf967932-0de6-11d0-a285-00aa003049e2","AD Attribute" +cACertificateDN,"963d2740-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAConnect,"963d2735-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAUsages,"963d2738-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAWEBURL,"963d2736-48be-11d1-a9c3-0000f80367c1","AD Attribute" +canUpgradeScript,"d9e18314-8939-11d1-aebc-0000f80367c1","AD Attribute" +canonicalName,"9a7ad945-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +carLicense,"d4159c92-957d-4a87-8a67-8d2934e01649","AD Attribute" +catalogs,"7bfdcb81-4807-11d1-a9c3-0000f80367c1","AD Attribute" +categories,"7bfdcb7e-4807-11d1-a9c3-0000f80367c1","AD Attribute" +categoryId,"7d6c0e94-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +certificateAuthorityObject,"963d2732-48be-11d1-a9c3-0000f80367c1","AD Attribute" +certificateRevocationList,"1677579f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +certificateTemplates,"2a39c5b1-8960-11d1-aebc-0000f80367c1","AD Attribute" +classDisplayName,"548e1c22-dea6-11d0-b010-0000f80367c1","AD Attribute" +codePage,"bf967938-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMClassID,"bf96793b-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMCLSID,"281416d9-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMInterfaceID,"bf96793c-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMOtherProgId,"281416dd-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMProgID,"bf96793d-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMTreatAsClassId,"281416db-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMTypelibId,"281416de-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMUniqueLIBID,"281416da-1968-11d0-a28f-00aa003049e2","AD Attribute" +info,"bf96793e-0de6-11d0-a285-00aa003049e2","AD Attribute" +cn,"bf96793f-0de6-11d0-a285-00aa003049e2","AD Attribute" +company,"f0f8ff88-1191-11d0-a060-00aa006c33ed","AD Attribute" +contentIndexingAllowed,"bf967943-0de6-11d0-a285-00aa003049e2","AD Attribute" +contextMenu,"4d8601ee-ac85-11d0-afe3-00c04fd930c9","AD Attribute" +controlAccessRights,"6da8a4fc-0e52-11d0-a286-00aa003049e2","AD Attribute" +cost,"bf967944-0de6-11d0-a285-00aa003049e2","AD Attribute" +countryCode,"5fd42471-1262-11d0-a060-00aa006c33ed","AD Attribute" +c,"bf967945-0de6-11d0-a285-00aa003049e2","AD Attribute" +createDialog,"2b09958a-8931-11d1-aebc-0000f80367c1","AD Attribute" +createTimeStamp,"2df90d73-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +createWizardExt,"2b09958b-8931-11d1-aebc-0000f80367c1","AD Attribute" +creationTime,"bf967946-0de6-11d0-a285-00aa003049e2","AD Attribute" +creationWizard,"4d8601ed-ac85-11d0-afe3-00c04fd930c9","AD Attribute" +creator,"7bfdcb85-4807-11d1-a9c3-0000f80367c1","AD Attribute" +cRLObject,"963d2737-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cRLPartitionedRevocationList,"963d2731-48be-11d1-a9c3-0000f80367c1","AD Attribute" +crossCertificatePair,"167757b2-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +currMachineId,"1f0075fe-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +currentLocation,"1f0075fc-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +currentParentCA,"963d273f-48be-11d1-a9c3-0000f80367c1","AD Attribute" +currentValue,"bf967947-0de6-11d0-a285-00aa003049e2","AD Attribute" +dBCSPwd,"bf96799c-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultClassStore,"bf967948-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultGroup,"720bc4e2-a54a-11d0-afdf-00c04fd930c9","AD Attribute" +defaultHidingValue,"b7b13116-b82e-11d0-afee-0000f80367c1","AD Attribute" +defaultLocalPolicyObject,"bf96799f-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultObjectCategory,"26d97367-6070-11d1-a9c6-0000f80367c1","AD Attribute" +defaultPriority,"281416c8-1968-11d0-a28f-00aa003049e2","AD Attribute" +defaultSecurityDescriptor,"807a6d30-1669-11d0-a064-00aa006c33ed","AD Attribute" +deltaRevocationList,"167757b5-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +department,"bf96794f-0de6-11d0-a285-00aa003049e2","AD Attribute" +departmentNumber,"be9ef6ee-cbc7-4f22-b27b-96967e7ee585","AD Attribute" +description,"bf967950-0de6-11d0-a285-00aa003049e2","AD Attribute" +desktopProfile,"eea65906-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +destinationIndicator,"bf967951-0de6-11d0-a285-00aa003049e2","AD Attribute" +dhcpClasses,"963d2750-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpFlags,"963d2741-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpIdentification,"963d2742-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpMask,"963d2747-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpMaxKey,"963d2754-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpObjDescription,"963d2744-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpObjName,"963d2743-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpOptions,"963d274f-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpProperties,"963d2753-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpRanges,"963d2748-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpReservations,"963d274a-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpServers,"963d2745-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpSites,"963d2749-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpState,"963d2752-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpSubnets,"963d2746-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpType,"963d273b-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpUniqueKey,"963d273a-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpUpdateTime,"963d2755-48be-11d1-a9c3-0000f80367c1","AD Attribute" +displayName,"bf967953-0de6-11d0-a285-00aa003049e2","AD Attribute" +displayNamePrintable,"bf967954-0de6-11d0-a285-00aa003049e2","AD Attribute" +dITContentRules,"9a7ad946-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +division,"fe6136a0-2073-11d0-a9c2-00aa006c33ed","AD Attribute" +dMDLocation,"f0f8ff8b-1191-11d0-a060-00aa006c33ed","AD Attribute" +dmdName,"167757b9-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +dNReferenceUpdate,"2df90d86-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +dnsAllowDynamic,"e0fa1e65-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dnsAllowXFR,"e0fa1e66-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSHostName,"72e39547-7b18-11d1-adef-00c04fd8d5cd","AD Attribute" +dnsNotifySecondaries,"e0fa1e68-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSProperty,"675a15fe-3b70-11d2-90cc-00c04fd91ab1","AD Attribute" +dnsRecord,"e0fa1e69-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dnsRoot,"bf967959-0de6-11d0-a285-00aa003049e2","AD Attribute" +dnsSecureSecondaries,"e0fa1e67-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSTombstoned,"d5eb2eb7-be4e-463b-a214-634a44d7392e","AD Attribute" +documentAuthor,"f18a8e19-af5f-4478-b096-6f35c27eb83f","AD Attribute" +documentIdentifier,"0b21ce82-ff63-46d9-90fb-c8b9f24e97b9","AD Attribute" +documentLocation,"b958b14e-ac6d-4ec4-8892-be70b69f7281","AD Attribute" +documentPublisher,"170f09d7-eb69-448a-9a30-f1afecfd32d7","AD Attribute" +documentTitle,"de265a9c-ff2c-47b9-91dc-6e6fe2c43062","AD Attribute" +documentVersion,"94b3a8a9-d613-4cec-9aad-5fbcc1046b43","AD Attribute" +domainCAs,"7bfdcb7a-4807-11d1-a9c3-0000f80367c1","AD Attribute" +dc,"19195a55-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +domainCrossRef,"b000ea7b-a086-11d0-afdd-00c04fd930c9","AD Attribute" +domainID,"963d2734-48be-11d1-a9c3-0000f80367c1","AD Attribute" +domainIdentifier,"7f561278-5301-11d1-a9c5-0000f80367c1","AD Attribute" +domainPolicyObject,"bf96795d-0de6-11d0-a285-00aa003049e2","AD Attribute" +domainPolicyReference,"80a67e2a-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +domainReplica,"bf96795e-0de6-11d0-a285-00aa003049e2","AD Attribute" +domainWidePolicy,"80a67e29-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +drink,"1a1aa5b5-262e-4df6-af04-2cf6b0d80048","AD Attribute" +driverName,"281416c5-1968-11d0-a28f-00aa003049e2","AD Attribute" +driverVersion,"ba305f6e-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +dSCorePropagationData,"d167aa4b-8b08-11d2-9939-0000f87a57d4","AD Attribute" +dSHeuristics,"f0f8ff86-1191-11d0-a060-00aa006c33ed","AD Attribute" +dSUIAdminMaximum,"ee8d0ae0-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSUIAdminNotification,"f6ea0a94-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSUIShellMaximum,"fcca766a-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSASignature,"167757bc-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +dynamicLDAPServer,"52458021-ca6a-11d0-afff-0000f80367c1","AD Attribute" +mail,"bf967961-0de6-11d0-a285-00aa003049e2","AD Attribute" +eFSPolicy,"8e4eb2ec-4712-11d0-a1a0-00c04fd930c9","AD Attribute" +employeeID,"bf967962-0de6-11d0-a285-00aa003049e2","AD Attribute" +employeeNumber,"a8df73ef-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +employeeType,"a8df73f0-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +Enabled,"a8df73f2-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +enabledConnection,"bf967963-0de6-11d0-a285-00aa003049e2","AD Attribute" +enrollmentProviders,"2a39c5b3-8960-11d1-aebc-0000f80367c1","AD Attribute" +entryTTL,"d213decc-d81a-4384-aac2-dcfcfd631cf8","AD Attribute" +extendedAttributeInfo,"9a7ad947-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +extendedCharsAllowed,"bf967966-0de6-11d0-a285-00aa003049e2","AD Attribute" +extendedClassInfo,"9a7ad948-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +extensionName,"bf967972-0de6-11d0-a285-00aa003049e2","AD Attribute" +extraColumns,"d24e2846-1dd9-4bcf-99d7-a6227cc86da7","AD Attribute" +facsimileTelephoneNumber,"bf967974-0de6-11d0-a285-00aa003049e2","AD Attribute" +fileExtPriority,"d9e18315-8939-11d1-aebc-0000f80367c1","AD Attribute" +flags,"bf967976-0de6-11d0-a285-00aa003049e2","AD Attribute" +flatName,"b7b13117-b82e-11d0-afee-0000f80367c1","AD Attribute" +forceLogoff,"bf967977-0de6-11d0-a285-00aa003049e2","AD Attribute" +foreignIdentifier,"3e97891e-8c01-11d0-afda-00c04fd930c9","AD Attribute" +friendlyNames,"7bfdcb88-4807-11d1-a9c3-0000f80367c1","AD Attribute" +fromEntry,"9a7ad949-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +fromServer,"bf967979-0de6-11d0-a285-00aa003049e2","AD Attribute" +frsComputerReference,"2a132578-9373-11d1-aebc-0000f80367c1","AD Attribute" +frsComputerReferenceBL,"2a132579-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlDataCreation,"2a13257a-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlInboundBacklog,"2a13257b-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlOutboundBacklog,"2a13257c-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSDirectoryFilter,"1be8f171-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSDSPoll,"1be8f177-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSExtensions,"52458020-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSFaultCondition,"1be8f178-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSFileFilter,"1be8f170-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSFlags,"2a13257d-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSLevelLimit,"5245801e-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSMemberReference,"2a13257e-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSMemberReferenceBL,"2a13257f-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSPartnerAuthLevel,"2a132580-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSPrimaryMember,"2a132581-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSReplicaSetGUID,"5245801a-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSReplicaSetType,"26d9736b-6070-11d1-a9c6-0000f80367c1","AD Attribute" +fRSRootPath,"1be8f174-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSRootSecurity,"5245801f-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSServiceCommand,"ddac0cee-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +fRSServiceCommandStatus,"2a132582-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSStagingPath,"1be8f175-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSTimeLastCommand,"2a132583-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSTimeLastConfigChange,"2a132584-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSUpdateTimeout,"1be8f172-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSVersion,"2a132585-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSVersionGUID,"26d9736c-6070-11d1-a9c6-0000f80367c1","AD Attribute" +fRSWorkingPath,"1be8f173-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fSMORoleOwner,"66171887-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +garbageCollPeriod,"5fd424a1-1262-11d0-a060-00aa006c33ed","AD Attribute" +generatedConnection,"bf96797a-0de6-11d0-a285-00aa003049e2","AD Attribute" +generationQualifier,"16775804-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +givenName,"f0f8ff8e-1191-11d0-a060-00aa006c33ed","AD Attribute" +globalAddressList,"f754c748-06f4-11d2-aa53-00c04fd7d83a","AD Attribute" +governsID,"bf96797d-0de6-11d0-a285-00aa003049e2","AD Attribute" +gPLink,"f30e3bbe-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPOptions,"f30e3bbf-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCFileSysPath,"f30e3bc1-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCFunctionalityVersion,"f30e3bc0-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCMachineExtensionNames,"32ff8ecc-783f-11d2-9916-0000f87a57d4","AD Attribute" +gPCUserExtensionNames,"42a75fc6-783f-11d2-9916-0000f87a57d4","AD Attribute" +gPCWQLFilter,"7bd4c7a6-1add-4436-8c04-3999a880154c","AD Attribute" +groupAttributes,"bf96797e-0de6-11d0-a285-00aa003049e2","AD Attribute" +groupMembershipSAM,"bf967980-0de6-11d0-a285-00aa003049e2","AD Attribute" +groupPriority,"eea65905-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +groupType,"9a9a021e-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +groupsToIgnore,"eea65904-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +hasMasterNCs,"bf967982-0de6-11d0-a285-00aa003049e2","AD Attribute" +hasPartialReplicaNCs,"bf967981-0de6-11d0-a285-00aa003049e2","AD Attribute" +helpData16,"5fd424a7-1262-11d0-a060-00aa006c33ed","AD Attribute" +helpData32,"5fd424a8-1262-11d0-a060-00aa006c33ed","AD Attribute" +helpFileName,"5fd424a9-1262-11d0-a060-00aa006c33ed","AD Attribute" +hideFromAB,"ec05b750-a977-4efe-8e8d-ba6c1a6e33a8","AD Attribute" +homeDirectory,"bf967985-0de6-11d0-a285-00aa003049e2","AD Attribute" +homeDrive,"bf967986-0de6-11d0-a285-00aa003049e2","AD Attribute" +houseIdentifier,"a45398b7-c44a-4eb6-82d3-13c10946dbfe","AD Attribute" +host,"6043df71-fa48-46cf-ab7c-cbd54644b22d","AD Attribute" +iconPath,"f0f8ff83-1191-11d0-a060-00aa006c33ed","AD Attribute" +implementedCategories,"7d6c0e92-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +indexedScopes,"7bfdcb87-4807-11d1-a9c3-0000f80367c1","AD Attribute" +initialAuthIncoming,"52458023-ca6a-11d0-afff-0000f80367c1","AD Attribute" +initialAuthOutgoing,"52458024-ca6a-11d0-afff-0000f80367c1","AD Attribute" +initials,"f0f8ff90-1191-11d0-a060-00aa006c33ed","AD Attribute" +installUiLevel,"96a7dd64-9118-11d1-aebc-0000f80367c1","AD Attribute" +instanceType,"bf96798c-0de6-11d0-a285-00aa003049e2","AD Attribute" +interSiteTopologyFailover,"b7c69e60-2cc7-11d2-854e-00a0c983f608","AD Attribute" +interSiteTopologyGenerator,"b7c69e5e-2cc7-11d2-854e-00a0c983f608","AD Attribute" +interSiteTopologyRenew,"b7c69e5f-2cc7-11d2-854e-00a0c983f608","AD Attribute" +internationalISDNNumber,"bf96798d-0de6-11d0-a285-00aa003049e2","AD Attribute" +invocationId,"bf96798e-0de6-11d0-a285-00aa003049e2","AD Attribute" +ipsecData,"b40ff81f-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecDataType,"b40ff81e-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecFilterReference,"b40ff823-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecID,"b40ff81d-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecISAKMPReference,"b40ff820-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecName,"b40ff81c-427a-11d1-a9c2-0000f80367c1","AD Attribute" +iPSECNegotiationPolicyAction,"07383075-91df-11d1-aebc-0000f80367c1","AD Attribute" +ipsecNegotiationPolicyReference,"b40ff822-427a-11d1-a9c2-0000f80367c1","AD Attribute" +iPSECNegotiationPolicyType,"07383074-91df-11d1-aebc-0000f80367c1","AD Attribute" +ipsecNFAReference,"b40ff821-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecOwnersReference,"b40ff824-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecPolicyReference,"b7b13118-b82e-11d0-afee-0000f80367c1","AD Attribute" +isCriticalSystemObject,"00fbf30d-91fe-11d1-aebc-0000f80367c1","AD Attribute" +isDefunct,"28630ebe-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +isDeleted,"bf96798f-0de6-11d0-a285-00aa003049e2","AD Attribute" +isEphemeral,"f4c453f0-c5f1-11d1-bbcb-0080c76670c0","AD Attribute" +memberOf,"bf967991-0de6-11d0-a285-00aa003049e2","AD Attribute" +isMemberOfPartialAttributeSet,"19405b9d-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +isPrivilegeHolder,"19405b9c-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +isRecycled,"8fb59256-55f1-444b-aacb-f5b482fe3459","AD Attribute" +isSingleValued,"bf967992-0de6-11d0-a285-00aa003049e2","AD Attribute" +jpegPhoto,"bac80572-09c4-4fa9-9ae6-7628d7adbe0e","AD Attribute" +keywords,"bf967993-0de6-11d0-a285-00aa003049e2","AD Attribute" +knowledgeInformation,"1677581f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +labeledURI,"c569bb46-c680-44bc-a273-e6c227d71b45","AD Attribute" +lastBackupRestorationTime,"1fbb0be8-ba63-11d0-afef-0000f80367c1","AD Attribute" +lastContentIndexed,"bf967995-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastKnownParent,"52ab8670-5709-11d1-a9c6-0000f80367c1","AD Attribute" +lastLogoff,"bf967996-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastLogon,"bf967997-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastLogonTimestamp,"c0e20a04-0e5a-4ff3-9482-5efeaecd7060","AD Attribute" +lastSetTime,"bf967998-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastUpdateSequence,"7d6c0e9c-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +lDAPAdminLimits,"7359a352-90f7-11d1-aebc-0000f80367c1","AD Attribute" +lDAPDisplayName,"bf96799a-0de6-11d0-a285-00aa003049e2","AD Attribute" +lDAPIPDenyList,"7359a353-90f7-11d1-aebc-0000f80367c1","AD Attribute" +legacyExchangeDN,"28630ebc-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +linkID,"bf96799b-0de6-11d0-a285-00aa003049e2","AD Attribute" +linkTrackSecret,"2ae80fe2-47b4-11d0-a1a4-00c04fd930c9","AD Attribute" +lmPwdHistory,"bf96799d-0de6-11d0-a285-00aa003049e2","AD Attribute" +localPolicyFlags,"bf96799e-0de6-11d0-a285-00aa003049e2","AD Attribute" +localPolicyReference,"80a67e4d-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +localeID,"bf9679a1-0de6-11d0-a285-00aa003049e2","AD Attribute" +l,"bf9679a2-0de6-11d0-a285-00aa003049e2","AD Attribute" +localizedDescription,"d9e18316-8939-11d1-aebc-0000f80367c1","AD Attribute" +localizationDisplayId,"a746f0d1-78d0-11d2-9916-0000f87a57d4","AD Attribute" +location,"09dcb79f-165f-11d0-a064-00aa006c33ed","AD Attribute" +lockOutObservationWindow,"bf9679a4-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutDuration,"bf9679a5-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutThreshold,"bf9679a6-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutTime,"28630ebf-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +thumbnailLogo,"bf9679a9-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonCount,"bf9679aa-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonHours,"bf9679ab-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonWorkstation,"bf9679ac-0de6-11d0-a285-00aa003049e2","AD Attribute" +lSACreationTime,"bf9679ad-0de6-11d0-a285-00aa003049e2","AD Attribute" +lSAModifiedCount,"bf9679ae-0de6-11d0-a285-00aa003049e2","AD Attribute" +machineArchitecture,"bf9679af-0de6-11d0-a285-00aa003049e2","AD Attribute" +machinePasswordChangeInterval,"c9b6358e-bb38-11d0-afef-0000f80367c1","AD Attribute" +machineRole,"bf9679b2-0de6-11d0-a285-00aa003049e2","AD Attribute" +machineWidePolicy,"80a67e4f-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +managedBy,"0296c120-40da-11d1-a9c0-0000f80367c1","AD Attribute" +managedObjects,"0296c124-40da-11d1-a9c0-0000f80367c1","AD Attribute" +manager,"bf9679b5-0de6-11d0-a285-00aa003049e2","AD Attribute" +mAPIID,"bf9679b7-0de6-11d0-a285-00aa003049e2","AD Attribute" +marshalledInterface,"bf9679b9-0de6-11d0-a285-00aa003049e2","AD Attribute" +masteredBy,"e48e64e0-12c9-11d3-9102-00c04fd91ab1","AD Attribute" +maxPwdAge,"bf9679bb-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxRenewAge,"bf9679bc-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxStorage,"bf9679bd-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxTicketAge,"bf9679be-0de6-11d0-a285-00aa003049e2","AD Attribute" +mayContain,"bf9679bf-0de6-11d0-a285-00aa003049e2","AD Attribute" +meetingAdvertiseScope,"11b6cc8b-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingApplication,"11b6cc83-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingBandwidth,"11b6cc92-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingBlob,"11b6cc93-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingContactInfo,"11b6cc87-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingDescription,"11b6cc7e-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingEndTime,"11b6cc91-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingID,"11b6cc7c-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingIP,"11b6cc89-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingIsEncrypted,"11b6cc8e-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingKeyword,"11b6cc7f-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingLanguage,"11b6cc84-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingLocation,"11b6cc80-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingMaxParticipants,"11b6cc85-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingName,"11b6cc7d-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingOriginator,"11b6cc86-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingOwner,"11b6cc88-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingProtocol,"11b6cc81-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingRating,"11b6cc8d-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingRecurrence,"11b6cc8f-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingScope,"11b6cc8a-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingStartTime,"11b6cc90-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingType,"11b6cc82-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingURL,"11b6cc8c-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +member,"bf9679c0-0de6-11d0-a285-00aa003049e2","AD Attribute" +mhsORAddress,"0296c122-40da-11d1-a9c0-0000f80367c1","AD Attribute" +minPwdAge,"bf9679c2-0de6-11d0-a285-00aa003049e2","AD Attribute" +minPwdLength,"bf9679c3-0de6-11d0-a285-00aa003049e2","AD Attribute" +minTicketAge,"bf9679c4-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifiedCount,"bf9679c5-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifiedCountAtLastProm,"bf9679c6-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifyTimeStamp,"9a7ad94a-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +moniker,"bf9679c7-0de6-11d0-a285-00aa003049e2","AD Attribute" +monikerDisplayName,"bf9679c8-0de6-11d0-a285-00aa003049e2","AD Attribute" +moveTreeState,"1f2ac2c8-3b71-11d2-90cc-00c04fd91ab1","AD Attribute" +"msCOM-DefaultPartitionLink","998b10f7-aa1a-4364-b867-753d197fe670","AD Attribute" +"msCOM-ObjectId","430f678b-889f-41f2-9843-203b5a65572f","AD Attribute" +"msCOM-PartitionLink","09abac62-043f-4702-ac2b-6ca15eee5754","AD Attribute" +"msCOM-PartitionSetLink","67f121dc-7d02-4c7d-82f5-9ad4c950ac34","AD Attribute" +"msCOM-UserLink","9e6f3a4d-242c-4f37-b068-36b57f9fc852","AD Attribute" +"msCOM-UserPartitionSetLink","8e940c8a-e477-4367-b08d-ff2ff942dcd7","AD Attribute" +"msDRM-IdentityCertificate","e85e1204-3434-41ad-9b56-e2901228fff0","AD Attribute" +"msDS-AdditionalDnsHostName","80863791-dbe9-4eb8-837e-7f0ab55d9ac7","AD Attribute" +"msDS-AdditionalSamAccountName","975571df-a4d5-429a-9f59-cdc6581d91e6","AD Attribute" +"msDS-AllUsersTrustQuota","d3aa4a5c-4e03-4810-97aa-2b339e7a434b","AD Attribute" +"msDS-AllowedDNSSuffixes","8469441b-9ac4-4e45-8205-bd219dbf672d","AD Attribute" +"msDS-AllowedToDelegateTo","800d94d7-b7a1-42a1-b14d-7cae1423d07f","AD Attribute" +"msDS-Auxiliary-Classes","c4af1073-ee50-4be0-b8c0-89a41fe99abe","AD Attribute" +"msDS-Approx-Immed-Subordinates","e185d243-f6ce-4adb-b496-b0c005d7823c","AD Attribute" +"msDS-AuthenticatedAtDC","3e1ee99c-6604-4489-89d9-84798a89515a","AD Attribute" +"msDS-AuthenticatedToAccountlist","e8b2c971-a6df-47bc-8d6f-62770d527aa5","AD Attribute" +"msDS-AzApplicationData","503fc3e8-1cc6-461a-99a3-9eee04f402a7","AD Attribute" +"msDS-AzApplicationName","db5b0728-6208-4876-83b7-95d3e5695275","AD Attribute" +"msDS-AzApplicationVersion","7184a120-3ac4-47ae-848f-fe0ab20784d4","AD Attribute" +"msDS-AzBizRule","33d41ea8-c0c9-4c92-9494-f104878413fd","AD Attribute" +"msDS-AzBizRuleLanguage","52994b56-0e6c-4e07-aa5c-ef9d7f5a0e25","AD Attribute" +"msDS-AzClassId","013a7277-5c2d-49ef-a7de-b765b36a3f6f","AD Attribute" +"msDS-AzDomainTimeout","6448f56a-ca70-4e2e-b0af-d20e4ce653d0","AD Attribute" +"msDS-AzGenerateAudits","f90abab0-186c-4418-bb85-88447c87222a","AD Attribute" +"msDS-AzLastImportedBizRulePath","665acb5c-bb92-4dbc-8c59-b3638eab09b3","AD Attribute" +"msDS-AzLDAPQuery","5e53368b-fc94-45c8-9d7d-daf31ee7112d","AD Attribute" +"msDS-AzMajorVersion","cfb9adb7-c4b7-4059-9568-1ed9db6b7248","AD Attribute" +"msDS-AzMinorVersion","ee85ed93-b209-4788-8165-e702f51bfbf3","AD Attribute" +"msDS-AzOperationID","a5f3b553-5d76-4cbe-ba3f-4312152cab18","AD Attribute" +"msDS-AzScopeName","515a6b06-2617-4173-8099-d5605df043c6","AD Attribute" +"msDS-AzScriptEngineCacheMax","2629f66a-1f95-4bf3-a296-8e9d7b9e30c8","AD Attribute" +"msDS-AzScriptTimeout","87d0fb41-2c8b-41f6-b972-11fdfd50d6b0","AD Attribute" +"msDS-AzTaskIsRoleDefinition","7b078544-6c82-4fe9-872f-ff48ad2b2e26","AD Attribute" +"msDS-AzObjectGuid","8491e548-6c38-4365-a732-af041569b02c","AD Attribute" +"msDS-AzGenericData","b5f7e349-7a5b-407c-a334-a31c3f538b98","AD Attribute" +"msDS-Behavior-Version","d31a8757-2447-4545-8081-3bb610cacbf2","AD Attribute" +"msDS-ByteArray","f0d8972e-dd5b-40e5-a51d-044c7c17ece7","AD Attribute" +"msDS-Cached-Membership","69cab008-cdd4-4bc9-bab8-0ff37efe1b20","AD Attribute" +"msDS-Cached-Membership-Time-Stamp","3566bf1f-beee-4dcb-8abe-ef89fcfec6c1","AD Attribute" +"mS-DS-ConsistencyGuid","23773dc2-b63a-11d2-90e1-00c04fd91ab1","AD Attribute" +"mS-DS-ConsistencyChildCount","178b7bc2-b63a-11d2-90e1-00c04fd91ab1","AD Attribute" +"mS-DS-CreatorSID","c5e60132-1480-11d3-91c1-0000f87a57d4","AD Attribute" +"msDS-DateTime","234fcbd8-fb52-4908-a328-fd9f6e58e403","AD Attribute" +"msDS-DefaultQuota","6818f726-674b-441b-8a3a-f40596374cea","AD Attribute" +"msDS-DeletedObjectLifetime","a9b38cb6-189a-4def-8a70-0fcfa158148e","AD Attribute" +"msDS-DnsRootAlias","2143acca-eead-4d29-b591-85fa49ce9173","AD Attribute" +"msDS-EnabledFeature","5706aeaf-b940-4fb2-bcfc-5268683ad9fe","AD Attribute" +"msDS-EnabledFeatureBL","ce5b01bc-17c6-44b8-9dc1-a9668b00901b","AD Attribute" +"msDS-Entry-Time-To-Die","e1e9bad7-c6dd-4101-a843-794cec85b038","AD Attribute" +"msDS-ExecuteScriptPassword","9d054a5a-d187-46c1-9d85-42dfc44a56dd","AD Attribute" +"msDS-ExternalKey","b92fd528-38ac-40d4-818d-0433380837c1","AD Attribute" +"msDS-ExternalStore","604877cd-9cdb-47c7-b03d-3daadb044910","AD Attribute" +"msDS-OptionalFeatureGUID","9b88bda8-dd82-4998-a91d-5f2d2baf1927","AD Attribute" +"msDS-FilterContainers","fb00dcdf-ac37-483a-9c12-ac53a6603033","AD Attribute" +"msDS-HasInstantiatedNCs","11e9a5bc-4517-4049-af9c-51554fb0fc09","AD Attribute" +"msDS-HasDomainNCs","6f17e347-a842-4498-b8b3-15e007da4fed","AD Attribute" +"msDS-hasMasterNCs","ae2de0e2-59d7-4d47-8d47-ed4dfe4357ad","AD Attribute" +"msDS-HostServiceAccount","80641043-15a2-40e1-92a2-8ca866f70776","AD Attribute" +"msDS-HostServiceAccountBL","79abe4eb-88f3-48e7-89d6-f4bc7e98c331","AD Attribute" +"msDS-Integer","7bc64cea-c04e-4318-b102-3e0729371a65","AD Attribute" +"msDS-IntId","bc60096a-1b47-4b30-8877-602c93f56532","AD Attribute" +"msDS-IsPossibleValuesPresent","6fabdcda-8c53-204f-b1a4-9df0c67c1eb4","AD Attribute" +"msDS-isGC","1df5cf33-0fe5-499e-90e1-e94b42718a46","AD Attribute" +"msDS-isRODC","a8e8aa23-3e67-4af1-9d7a-2f1a1d633ac9","AD Attribute" +"msDS-LastKnownRDN","8ab15858-683e-466d-877f-d640e1f9a611","AD Attribute" +"msDS-KeyVersionNumber","c523e9c0-33b5-4ac8-8923-b57b927f42f6","AD Attribute" +"msDS-LogonTimeSyncInterval","ad7940f8-e43a-4a42-83bc-d688e59ea605","AD Attribute" +"msDs-masteredBy","60234769-4819-4615-a1b2-49d2f119acb5","AD Attribute" +"msDS-MaximumPasswordAge","fdd337f5-4999-4fce-b252-8ff9c9b43875","AD Attribute" +"msDS-MinimumPasswordAge","2a74f878-4d9c-49f9-97b3-6767d1cbd9a3","AD Attribute" +"msDS-MinimumPasswordLength","b21b3439-4c3a-441c-bb5f-08f20e9b315e","AD Attribute" +"msDS-OIDToGroupLink","f9c9a57c-3941-438d-bebf-0edaf2aca187","AD Attribute" +"msDS-OIDToGroupLinkBl","1a3d0d20-5844-4199-ad25-0f5039a76ada","AD Attribute" +"msDS-PasswordHistoryLength","fed81bb7-768c-4c2f-9641-2245de34794d","AD Attribute" +"msDS-PasswordComplexityEnabled","db68054b-c9c3-4bf0-b15b-0fb52552a610","AD Attribute" +"msDS-PasswordReversibleEncryptionEnabled","75ccdd8f-af6c-4487-bb4b-69e4d38a959c","AD Attribute" +"msDS-LocalEffectiveDeletionTime","94f2800c-531f-4aeb-975d-48ac39fd8ca4","AD Attribute" +"msDS-LocalEffectiveRecycleTime","4ad6016b-b0d2-4c9b-93b6-5964b17b968c","AD Attribute" +"msDS-LockoutObservationWindow","b05bda89-76af-468a-b892-1be55558ecc8","AD Attribute" +"msDS-LockoutDuration","421f889a-472e-4fe4-8eb9-e1d0bc6071b2","AD Attribute" +"msDS-LockoutThreshold","b8c8c35e-4a19-4a95-99d0-69fe4446286f","AD Attribute" +"msDS-PSOAppliesTo","64c80f48-cdd2-4881-a86d-4e97b6f561fc","AD Attribute" +"msDS-PSOApplied","5e6cf031-bda8-43c8-aca4-8fee4127005b","AD Attribute" +"msDS-RequiredDomainBehaviorVersion","eadd3dfe-ae0e-4cc2-b9b9-5fe5b6ed2dd2","AD Attribute" +"msDS-RequiredForestBehaviorVersion","4beca2e8-a653-41b2-8fee-721575474bec","AD Attribute" +"msDS-ResultantPSO","b77ea093-88d0-4780-9a98-911f8e8b1dca","AD Attribute" +"msDS-PasswordSettingsPrecedence","456374ac-1f0a-4617-93cf-bc55a7c9d341","AD Attribute" +"msDs-MaxValues","d1e169a4-ebe9-49bf-8fcb-8aef3874592d","AD Attribute" +"msDS-MembersForAzRole","cbf7e6cd-85a4-4314-8939-8bfe80597835","AD Attribute" +"msDS-MembersForAzRoleBL","ececcd20-a7e0-4688-9ccf-02ece5e287f5","AD Attribute" +"msDS-NcType","5a2eacd7-cc2b-48cf-9d9a-b6f1a0024de9","AD Attribute" +"msDS-NonMembers","cafcb1de-f23c-46b5-adf7-1e64957bd5db","AD Attribute" +"msDS-NonMembersBL","2a8c68fc-3a7a-4e87-8720-fe77c51cbe74","AD Attribute" +"msDS-PhoneticFirstName","4b1cba4e-302f-4134-ac7c-f01f6c797843","AD Attribute" +"msDS-PhoneticLastName","f217e4ec-0836-4b90-88af-2f5d4bbda2bc","AD Attribute" +"msDS-PhoneticDepartment","6cd53daf-003e-49e7-a702-6fa896e7a6ef","AD Attribute" +"msDS-PhoneticCompanyName","5bd5208d-e5f4-46ae-a514-543bc9c47659","AD Attribute" +"msDS-PhoneticDisplayName","e21a94e4-2d66-4ce5-b30d-0ef87a776ff0","AD Attribute" +"msDS-HABSeniorityIndex","def449f1-fd3b-4045-98cf-d9658da788b5","AD Attribute" +"msDS-PromotionSettings","c881b4e2-43c0-4ebe-b9bb-5250aa9b434c","AD Attribute" +"msDS-SiteName","98a7f36d-3595-448a-9e6f-6b8965baed9c","AD Attribute" +"msDS-SupportedEncryptionTypes","20119867-1d04-4ab7-9371-cfc3d5df0afd","AD Attribute" +"msDS-TrustForestTrustInfo","29cc866e-49d3-4969-942e-1dbc0925d183","AD Attribute" +"msDS-TombstoneQuotaFactor","461744d7-f3b6-45ba-8753-fb9552a5df32","AD Attribute" +"msDS-TopQuotaUsage","7b7cce4f-f1f5-4bb6-b7eb-23504af19e75","AD Attribute" +"ms-DS-MachineAccountQuota","d064fb68-1480-11d3-91c1-0000f87a57d4","AD Attribute" +"msDS-ObjectReference","638ec2e8-22e7-409c-85d2-11b21bee72de","AD Attribute" +"msDS-ObjectReferenceBL","2b702515-c1f7-4b3b-b148-c0e4c6ceecb4","AD Attribute" +"msDS-OperationsForAzRole","93f701be-fa4c-43b6-bc2f-4dbea718ffab","AD Attribute" +"msDS-OperationsForAzRoleBL","f85b6228-3734-4525-b6b7-3f3bb220902c","AD Attribute" +"msDS-OperationsForAzTask","1aacb436-2e9d-44a9-9298-ce4debeb6ebf","AD Attribute" +"msDS-OperationsForAzTaskBL","a637d211-5739-4ed1-89b2-88974548bc59","AD Attribute" +"msDS-Other-Settings","79d2f34c-9d7d-42bb-838f-866b3e4400e2","AD Attribute" +"msDS-PrincipalName","564e9325-d057-c143-9e3b-4f9e5ef46f93","AD Attribute" +"msDS-QuotaAmount","fbb9a00d-3a8c-4233-9cf9-7189264903a1","AD Attribute" +"msDS-QuotaEffective","6655b152-101c-48b4-b347-e1fcebc60157","AD Attribute" +"msDS-QuotaTrustee","16378906-4ea5-49be-a8d1-bfd41dff4f65","AD Attribute" +"msDS-QuotaUsed","b5a84308-615d-4bb7-b05f-2f1746aa439f","AD Attribute" +"msDS-NCReplCursors","8a167ce4-f9e8-47eb-8d78-f7fe80abb2cc","AD Attribute" +"msDS-NCReplInboundNeighbors","9edba85a-3e9e-431b-9b1a-a5b6e9eda796","AD Attribute" +"msDS-NCReplOutboundNeighbors","855f2ef5-a1c5-4cc4-ba6d-32522848b61f","AD Attribute" +"msDS-NC-Replica-Locations","97de9615-b537-46bc-ac0f-10720f3909f3","AD Attribute" +"msDS-NC-RO-Replica-Locations","3df793df-9858-4417-a701-735a1ecebf74","AD Attribute" +"msDS-NC-RO-Replica-Locations-BL","f547511c-5b2a-44cc-8358-992a88258164","AD Attribute" +"msDS-Non-Security-Group-Extra-Classes","2de144fc-1f52-486f-bdf4-16fcc3084e54","AD Attribute" +"msDS-PerUserTrustQuota","d161adf0-ca24-4993-a3aa-8b2c981302e8","AD Attribute" +"msDS-PerUserTrustTombstonesQuota","8b70a6c6-50f9-4fa3-a71e-1ce03040449b","AD Attribute" +"msDS-Preferred-GC-Site","d921b50a-0ab2-42cd-87f6-09cf83a91854","AD Attribute" +"msDS-ReplAttributeMetaData","d7c53242-724e-4c39-9d4c-2df8c9d66c7a","AD Attribute" +"msDS-ReplValueMetaData","2f5c8145-e1bd-410b-8957-8bfa81d5acfd","AD Attribute" +"mS-DS-ReplicatesNCReason","0ea12b84-08b3-11d3-91bc-0000f87a57d4","AD Attribute" +"msDS-Replication-Notify-First-DSA-Delay","85abd4f4-0a89-4e49-bdec-6f35bb2562ba","AD Attribute" +"msDS-Replication-Notify-Subsequent-DSA-Delay","d63db385-dd92-4b52-b1d8-0d3ecc0e86b6","AD Attribute" +"msDS-ReplicationEpoch","08e3aa79-eb1c-45b5-af7b-8f94246c8e41","AD Attribute" +"msDS-RetiredReplNCSignatures","d5b35506-19d6-4d26-9afb-11357ac99b5e","AD Attribute" +"msDs-Schema-Extensions","b39a61be-ed07-4cab-9a4a-4963ed0141e1","AD Attribute" +"msDS-SDReferenceDomain","4c51e316-f628-43a5-b06b-ffb695fcb4f3","AD Attribute" +"msDS-Security-Group-Extra-Classes","4f146ae8-a4fe-4801-a731-f51848a4f4e4","AD Attribute" +"msDS-Settings","0e1b47d7-40a3-4b48-8d1b-4cac0c1cdf21","AD Attribute" +"msDS-Site-Affinity","c17c5602-bcb7-46f0-9656-6370ca884b72","AD Attribute" +"msDS-SPNSuffixes","789ee1eb-8c8e-4e4c-8cec-79b31b7617b5","AD Attribute" +"msDS-TasksForAzRole","35319082-8c4a-4646-9386-c2949d49894d","AD Attribute" +"msDS-TasksForAzRoleBL","a0dcd536-5158-42fe-8c40-c00a7ad37959","AD Attribute" +"msDS-TasksForAzTask","b11c8ee2-5fcd-46a7-95f0-f38333f096cf","AD Attribute" +"msDS-TasksForAzTaskBL","df446e52-b5fa-4ca2-a42f-13f98a526c8f","AD Attribute" +"msDS-User-Account-Control-Computed","2cc4b836-b63f-4940-8d23-ea7acf06af56","AD Attribute" +"msDS-UserPasswordExpiryTimeComputed","add5cf10-7b09-4449-9ae6-2534148f8a72","AD Attribute" +"msDS-UpdateScript","146eb639-bb9f-4fc1-a825-e29e00c77920","AD Attribute" +"msDS-SourceObjectDN","773e93af-d3b4-48d4-b3f9-06457602d3d0","AD Attribute" +"msDS-KrbTgtLink","778ff5c9-6f4e-4b74-856a-d68383313910","AD Attribute" +"msDS-RevealedUsers","185c7821-3749-443a-bd6a-288899071adb","AD Attribute" +"msDS-hasFullReplicaNCs","1d3c2d18-42d0-4868-99fe-0eca1e6fa9f3","AD Attribute" +"msDS-NeverRevealGroup","15585999-fd49-4d66-b25d-eeb96aba8174","AD Attribute" +"msDS-RevealOnDemandGroup","303d9f4a-1dd6-4b38-8fc5-33afe8c988ad","AD Attribute" +"msDS-SecondaryKrbTgtNumber","aa156612-2396-467e-ad6a-28d23fdb1865","AD Attribute" +"msDS-RevealedDSAs","94f6f2ac-c76d-4b5e-b71f-f332c3e93c22","AD Attribute" +"msDS-KrbTgtLinkBl","5dd68c41-bfdf-438b-9b5d-39d9618bf260","AD Attribute" +"msDS-IsFullReplicaFor","c8bc72e0-a6b4-48f0-94a5-fd76a88c9987","AD Attribute" +"msDS-IsDomainFor","ff155a2a-44e5-4de0-8318-13a58988de4f","AD Attribute" +"msDS-IsPartialReplicaFor","37c94ff6-c6d4-498f-b2f9-c6f7f8647809","AD Attribute" +"msDS-IsUserCachableAtRodc","fe01245a-341f-4556-951f-48c033a89050","AD Attribute" +"msDS-RevealedList","cbdad11c-7fec-387b-6219-3a0627d9af81","AD Attribute" +"msDS-RevealedListBL","aa1c88fd-b0f6-429f-b2ca-9d902266e808","AD Attribute" +"msDS-LastSuccessfulInteractiveLogonTime","011929e6-8b5d-4258-b64a-00b0b4949747","AD Attribute" +"msDS-LastFailedInteractiveLogonTime","c7e7dafa-10c3-4b8b-9acd-54f11063742e","AD Attribute" +"msDS-FailedInteractiveLogonCount","dc3ca86f-70ad-4960-8425-a4d6313d93dd","AD Attribute" +"msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon","c5d234e5-644a-4403-a665-e26e0aef5e98","AD Attribute" +"msDS-USNLastSyncSuccess","31f7b8b6-c9f8-4f2d-a37b-58a823030331","AD Attribute" +"msDS-ValueTypeReference","78fc5d84-c1dc-3148-8984-58f792d41d3e","AD Attribute" +"msDS-ValueTypeReferenceBL","ab5543ad-23a1-3b45-b937-9b313d5474a8","AD Attribute" +"msDS-OptionalFeatureFlags","8a0560c1-97b9-4811-9db7-dc061598965b","AD Attribute" +"msds-tokenGroupNames","65650576-4699-4fc9-8d18-26e0cd0137a6","AD Attribute" +"msds-tokenGroupNamesGlobalAndUniversal","fa06d1f4-7922-4aad-b79c-b2201f54417c","AD Attribute" +"msds-tokenGroupNamesNoGCAcceptable","523fc6c8-9af4-4a02-9cd7-3dea129eeb27","AD Attribute" +msExchAssistantName,"a8df7394-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +msExchHouseIdentifier,"a8df7407-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +msExchLabeledURI,"16775820-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +ownerBL,"bf9679f4-0de6-11d0-a285-00aa003049e2","AD Attribute" +"msFRS-Hub-Member","5643ff81-35b6-4ca9-9512-baf0bd0a2772","AD Attribute" +"msFRS-Topology-Pref","92aa27e0-5c50-402d-9ec1-ee847def9788","AD Attribute" +"msDFSR-Version","1a861408-38c3-49ea-ba75-85481a77c655","AD Attribute" +"msDFSR-Extension","78f011ec-a766-4b19-adcf-7b81ed781a4d","AD Attribute" +"msDFSR-RootPath","d7d5e8c1-e61f-464f-9fcf-20bbe0a2ec54","AD Attribute" +"msDFSR-RootSizeInMb","90b769ac-4413-43cf-ad7a-867142e740a3","AD Attribute" +"msDFSR-StagingPath","86b9a69e-f0a6-405d-99bb-77d977992c2a","AD Attribute" +"msDFSR-StagingSizeInMb","250a8f20-f6fc-4559-ae65-e4b24c67aebe","AD Attribute" +"msDFSR-ConflictPath","5cf0bcc8-60f7-4bff-bda6-aea0344eb151","AD Attribute" +"msDFSR-ConflictSizeInMb","9ad33fc9-aacf-4299-bb3e-d1fc6ea88e49","AD Attribute" +"msDFSR-Enabled","03726ae7-8e7d-4446-8aae-a91657c00993","AD Attribute" +"msDFSR-ReplicationGroupType","eeed0fc8-1001-45ed-80cc-bbf744930720","AD Attribute" +"msDFSR-TombstoneExpiryInMin","23e35d4c-e324-4861-a22f-e199140dae00","AD Attribute" +"msDFSR-FileFilter","d68270ac-a5dc-4841-a6ac-cd68be38c181","AD Attribute" +"msDFSR-DirectoryFilter","93c7b477-1f2e-4b40-b7bf-007e8d038ccf","AD Attribute" +"msDFSR-Schedule","4699f15f-a71f-48e2-9ff5-5897c0759205","AD Attribute" +"msDFSR-Keywords","048b4692-6227-4b67-a074-c4437083e14b","AD Attribute" +"msDFSR-Flags","fe515695-3f61-45c8-9bfa-19c148c57b09","AD Attribute" +"msDFSR-Options","d6d67084-c720-417d-8647-b696237a114c","AD Attribute" +"msDFSR-ContentSetGuid","1035a8e1-67a8-4c21-b7bb-031cdf99d7a0","AD Attribute" +"msDFSR-RdcEnabled","e3b44e05-f4a7-4078-a730-f48670a743f8","AD Attribute" +"msDFSR-RdcMinFileSizeInKb","f402a330-ace5-4dc1-8cc9-74d900bf8ae0","AD Attribute" +"msDFSR-DfsPath","2cc903e2-398c-443b-ac86-ff6b01eac7ba","AD Attribute" +"msDFSR-RootFence","51928e94-2cd8-4abe-b552-e50412444370","AD Attribute" +"msDFSR-ReplicationGroupGuid","2dad8796-7619-4ff8-966e-0a5cc67b287f","AD Attribute" +"msDFSR-DfsLinkTarget","f7b85ba9-3bf9-428f-aab4-2eee6d56f063","AD Attribute" +"msDFSR-MemberReference","261337aa-f1c3-44b2-bbea-c88d49e6f0c7","AD Attribute" +"msDFSR-ComputerReference","6c7b5785-3d21-41bf-8a8a-627941544d5a","AD Attribute" +"msDFSR-MemberReferenceBL","adde62c6-1880-41ed-bd3c-30b7d25e14f0","AD Attribute" +"msDFSR-ComputerReferenceBL","5eb526d7-d71b-44ae-8cc6-95460052e6ac","AD Attribute" +"msDFSR-Priority","eb20e7d6-32ad-42de-b141-16ad2631b01b","AD Attribute" +"msDFSR-DeletedPath","817cf0b8-db95-4914-b833-5a079ef65764","AD Attribute" +"msDFSR-DeletedSizeInMb","53ed9ad1-9975-41f4-83f5-0c061a12553a","AD Attribute" +"msDFSR-ReadOnly","5ac48021-e447-46e7-9d23-92c0c6a90dfb","AD Attribute" +"msDFSR-CachePolicy","db7a08e7-fc76-4569-a45f-f5ecb66a88b5","AD Attribute" +"msDFSR-MinDurationCacheInMin","4c5d607a-ce49-444a-9862-82a95f5d1fcc","AD Attribute" +"msDFSR-MaxAgeInCacheInMin","2ab0e48d-ac4e-4afc-83e5-a34240db6198","AD Attribute" +"msFVE-RecoveryPassword","43061ac1-c8ad-4ccc-b785-2bfac20fc60a","AD Attribute" +"msFVE-VolumeGuid","85e5a5cf-dcee-4075-9cfd-ac9db6a2f245","AD Attribute" +"msFVE-KeyPackage","1fd55ea8-88a7-47dc-8129-0daa97186a54","AD Attribute" +"msFVE-RecoveryGuid","f76909bc-e678-47a0-b0b3-f86a0044c06d","AD Attribute" +"msTPM-OwnerInformation","aa4e1a6d-550d-4e05-8c35-4afcb917a9fe","AD Attribute" +"msieee80211-Data","0e0d0938-2658-4580-a9f6-7a0ac7b566cb","AD Attribute" +"msieee80211-DataType","6558b180-35da-4efe-beed-521f8f48cafb","AD Attribute" +"msieee80211-ID","7f73ef75-14c9-4c23-81de-dd07a06f9e8b","AD Attribute" +"msIIS-FTPDir","8a5c99e9-2230-46eb-b8e8-e59d712eb9ee","AD Attribute" +"msIIS-FTPRoot","2a7827a4-1483-49a5-9d84-52e3812156b4","AD Attribute" +"msImaging-PSPIdentifier","51583ce9-94fa-4b12-b990-304c35b18595","AD Attribute" +"msImaging-PSPString","7b6760ae-d6ed-44a6-b6be-9de62c09ec67","AD Attribute" +"ms-net-ieee-80211-GP-PolicyGUID","35697062-1eaf-448b-ac1e-388e0be4fdee","AD Attribute" +"ms-net-ieee-80211-GP-PolicyData","9c1495a5-4d76-468e-991e-1433b0a67855","AD Attribute" +"ms-net-ieee-80211-GP-PolicyReserved","0f69c62e-088e-4ff5-a53a-e923cec07c0a","AD Attribute" +"ms-net-ieee-8023-GP-PolicyGUID","94a7b05a-b8b2-4f59-9c25-39e69baa1684","AD Attribute" +"ms-net-ieee-8023-GP-PolicyData","8398948b-7457-4d91-bd4d-8d7ed669c9f7","AD Attribute" +"ms-net-ieee-8023-GP-PolicyReserved","d3c527c7-2606-4deb-8cfd-18426feec8ce","AD Attribute" +"msPKI-Cert-Template-OID","3164c36a-ba26-468c-8bda-c1e5cc256728","AD Attribute" +"msPKI-Certificate-Application-Policy","dbd90548-aa37-4202-9966-8c537ba5ce32","AD Attribute" +"msPKI-Certificate-Name-Flag","ea1dddc4-60ff-416e-8cc0-17cee534bce7","AD Attribute" +"msPKI-Certificate-Policy","38942346-cc5b-424b-a7d8-6ffd12029c5f","AD Attribute" +"msPKI-CredentialRoamingTokens","b7ff5a38-0818-42b0-8110-d3d154c97f24","AD Attribute" +"msPKI-Enrollment-Flag","d15ef7d8-f226-46db-ae79-b34e560bd12c","AD Attribute" +"msPKI-Enrollment-Servers","f22bd38f-a1d0-4832-8b28-0331438886a6","AD Attribute" +"msPKI-Minimal-Key-Size","e96a63f5-417f-46d3-be52-db7703c503df","AD Attribute" +"msPKI-OID-Attribute","8c9e1288-5028-4f4f-a704-76d026f246ef","AD Attribute" +"msPKI-OID-CPS","5f49940e-a79f-4a51-bb6f-3d446a54dc6b","AD Attribute" +"msPKI-OIDLocalizedName","7d59a816-bb05-4a72-971f-5c1331f67559","AD Attribute" +"msPKI-OID-User-Notice","04c4da7a-e114-4e69-88de-e293f2d3b395","AD Attribute" +"msPKI-Private-Key-Flag","bab04ac2-0435-4709-9307-28380e7c7001","AD Attribute" +"msPKI-Site-Name","0cd8711f-0afc-4926-a4b1-09b08d3d436c","AD Attribute" +"msPKI-Supersede-Templates","9de8ae7d-7a5b-421d-b5e4-061f79dfd5d7","AD Attribute" +"msPKI-Template-Minor-Revision","13f5236c-1884-46b1-b5d0-484e38990d58","AD Attribute" +"msPKI-Template-Schema-Version","0c15e9f5-491d-4594-918f-32813a091da9","AD Attribute" +"msPKI-RA-Application-Policies","3c91fbbf-4773-4ccd-a87b-85d53e7bcf6a","AD Attribute" +"msPKI-RA-Policies","d546ae22-0951-4d47-817e-1c9f96faad46","AD Attribute" +"msPKI-RA-Signature","fe17e04b-937d-4f7e-8e0e-9292c8d5683e","AD Attribute" +msPKIRoamingTimeStamp,"6617e4ac-a2f1-43ab-b60c-11fbd1facf05","AD Attribute" +msPKIDPAPIMasterKeys,"b3f93023-9239-4f7c-b99c-6745d87adbc2","AD Attribute" +msPKIAccountCredentials,"b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7","AD Attribute" +msRRASAttribute,"f39b98ad-938d-11d1-aebd-0000f80367c1","AD Attribute" +msRRASVendorAttributeEntry,"f39b98ac-938d-11d1-aebd-0000f80367c1","AD Attribute" +"msRADIUS-FramedInterfaceId","a6f24a23-d65c-4d65-a64f-35fb6873c2b9","AD Attribute" +"msRADIUS-SavedFramedInterfaceId","a4da7289-92a3-42e5-b6b6-dad16d280ac9","AD Attribute" +"msRADIUS-FramedIpv6Prefix","f63ed610-d67c-494d-87be-cd1e24359a38","AD Attribute" +"msRADIUS-SavedFramedIpv6Prefix","0965a062-b1e1-403b-b48d-5c0eb0e952cc","AD Attribute" +"msRADIUS-FramedIpv6Route","5a5aa804-3083-4863-94e5-018a79a22ec0","AD Attribute" +"msRADIUS-SavedFramedIpv6Route","9666bb5c-df9d-4d41-b437-2eec7e27c9b3","AD Attribute" +"mS-SQL-Name","3532dfd8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-RegisteredOwner","48fd44ea-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Contact","4f6cbdd8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Location","561c9644-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Memory","5b5d448c-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Build","603e94c4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-ServiceAccount","64933a3e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-CharacterSet","696177a6-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-SortOrder","6ddc42c0-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-UnicodeSortOrder","72dc918a-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Clustered","7778bd90-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-NamedPipe","7b91c840-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-MultiProtocol","8157fa38-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-SPX","86b08004-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-TCPIP","8ac263a6-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-AppleTalk","8fda89f4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Vines","94c56394-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Status","9a7d4770-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastUpdatedDate","9fcc43d4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-InformationURL","a42cd510-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-ConnectionURL","a92d23da-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-PublicationURL","ae0c11b8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSLatitude","b222ba0e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSLongitude","b7577c94-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSHeight","bcdd4f0e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Version","c07cc1d0-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Language","c57f72f4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Description","8386603c-ccef-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Type","ca48eba8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-InformationDirectory","d0aedb2e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Database","d5a0dbdc-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-AllowAnonymousSubscription","db77be4a-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Alias","e0c6baae-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Size","e9098084-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-CreationDate","ede14754-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastBackupDate","f2b6abca-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastDiagnosticDate","f6d6dd88-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Applications","fbcda2ea-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Keywords","01e9a98a-ccef-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Publisher","c1676858-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowKnownPullSubscription","c3bb7054-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowImmediateUpdatingSubscription","c4186b6e-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowQueuedUpdatingSubscription","c458ca80-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowSnapshotFilesFTPDownloading","c49b8be8-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-ThirdParty","c4e311fc-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"msTAPI-ConferenceBlob","4cc4601e-7201-4141-abc8-3e529ae88863","AD Attribute" +"msTAPI-IpAddress","efd7d7f7-178e-4767-87fa-f8a16b840544","AD Attribute" +"msTAPI-ProtocolId","89c1ebcf-7a5f-41fd-99ca-c900b32299ab","AD Attribute" +"msTAPI-uid","70a4e7ea-b3b9-4643-8918-e6dd2471bfd4","AD Attribute" +"msWMI-Author","6366c0c1-6972-4e66-b3a5-1d52ad0c0547","AD Attribute" +"msWMI-ChangeDate","f9cdf7a0-ec44-4937-a79b-cd91522b3aa8","AD Attribute" +"msWMI-Class","90c1925f-4a24-4b07-b202-be32eb3c8b74","AD Attribute" +"msWMI-ClassDefinition","2b9c0ebc-c272-45cb-99d2-4d0e691632e0","AD Attribute" +"msWMI-CreationDate","748b0a2e-3351-4b3f-b171-2f17414ea779","AD Attribute" +"msWMI-Genus","50c8673a-8f56-4614-9308-9e1340fb9af3","AD Attribute" +"msWMI-ID","9339a803-94b8-47f7-9123-a853b9ff7e45","AD Attribute" +"msWMI-IntDefault","1b0c07f8-76dd-4060-a1e1-70084619dc90","AD Attribute" +"msWMI-intFlags1","18e006b9-6445-48e3-9dcf-b5ecfbc4df8e","AD Attribute" +"msWMI-intFlags2","075a42c9-c55a-45b1-ac93-eb086b31f610","AD Attribute" +"msWMI-intFlags3","f29fa736-de09-4be4-b23a-e734c124bacc","AD Attribute" +"msWMI-intFlags4","bd74a7ac-c493-4c9c-bdfa-5c7b119ca6b2","AD Attribute" +"msWMI-IntMax","fb920c2c-f294-4426-8ac1-d24b42aa2bce","AD Attribute" +"msWMI-IntMin","68c2e3ba-9837-4c70-98e0-f0c33695d023","AD Attribute" +"msWMI-IntValidValues","6af565f6-a749-4b72-9634-3c5d47e6b4e0","AD Attribute" +"msWMI-Int8Default","f4d8085a-8c5b-4785-959b-dc585566e445","AD Attribute" +"msWMI-Int8Max","e3d8b547-003d-4946-a32b-dc7cedc96b74","AD Attribute" +"msWMI-Int8Min","ed1489d1-54cc-4066-b368-a00daa2664f1","AD Attribute" +"msWMI-Int8ValidValues","103519a9-c002-441b-981a-b0b3e012c803","AD Attribute" +"msWMI-Mof","6736809f-2064-443e-a145-81262b1f1366","AD Attribute" +"msWMI-Name","c6c8ace5-7e81-42af-ad72-77412c5941c4","AD Attribute" +"msWMI-NormalizedClass","eaba628f-eb8e-4fe9-83fc-693be695559b","AD Attribute" +"msWMI-Parm1","27e81485-b1b0-4a8b-bedd-ce19a837e26e","AD Attribute" +"msWMI-Parm2","0003508e-9c42-4a76-a8f4-38bf64bab0de","AD Attribute" +"msWMI-Parm3","45958fb6-52bd-48ce-9f9f-c2712d9f2bfc","AD Attribute" +"msWMI-Parm4","3800d5a3-f1ce-4b82-a59a-1528ea795f59","AD Attribute" +"msWMI-PropertyName","ab920883-e7f8-4d72-b4a0-c0449897509d","AD Attribute" +"msWMI-Query","65fff93e-35e3-45a3-85ae-876c6718297f","AD Attribute" +"msWMI-QueryLanguage","7d3cfa98-c17b-4254-8bd7-4de9b932a345","AD Attribute" +"msWMI-ScopeGuid","87b78d51-405f-4b7f-80ed-2bd28786f48d","AD Attribute" +"msWMI-SourceOrganization","34f7ed6c-615d-418d-aa00-549a7d7be03e","AD Attribute" +"msWMI-StringDefault","152e42b6-37c5-4f55-ab48-1606384a9aea","AD Attribute" +"msWMI-StringValidValues","37609d31-a2bf-4b58-8f53-2b64e57a076d","AD Attribute" +"msWMI-TargetClass","95b6d8d6-c9e8-4661-a2bc-6a5cabc04c62","AD Attribute" +"msWMI-TargetNameSpace","1c4ab61f-3420-44e5-849d-8b5dbf60feb7","AD Attribute" +"msWMI-TargetObject","c44f67a5-7de5-4a1f-92d9-662b57364b77","AD Attribute" +"msWMI-TargetPath","5006a79a-6bfe-4561-9f52-13cf4dd3e560","AD Attribute" +"msWMI-TargetType","ca2a281e-262b-4ff7-b419-bc123352a4e9","AD Attribute" +mscopeId,"963d2751-48be-11d1-a9c3-0000f80367c1","AD Attribute" +msiFileList,"7bfdcb7d-4807-11d1-a9c3-0000f80367c1","AD Attribute" +msiScript,"d9e18313-8939-11d1-aebc-0000f80367c1","AD Attribute" +msiScriptName,"96a7dd62-9118-11d1-aebc-0000f80367c1","AD Attribute" +msiScriptPath,"bf967937-0de6-11d0-a285-00aa003049e2","AD Attribute" +msiScriptSize,"96a7dd63-9118-11d1-aebc-0000f80367c1","AD Attribute" +mSMQAuthenticate,"9a0dc326-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQBasePriority,"9a0dc323-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQComputerType,"9a0dc32e-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQComputerTypeEx,"18120de8-f4c4-4341-bd95-32eb5bcf7c80","AD Attribute" +mSMQCost,"9a0dc33a-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQCSPName,"9a0dc334-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQDependentClientService,"2df90d83-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDependentClientServices,"2df90d76-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDigests,"9a0dc33c-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQDigestsMig,"0f71d8e0-da3b-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQDsService,"2df90d82-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDsServices,"2df90d78-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQEncryptKey,"9a0dc331-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQForeign,"9a0dc32f-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQInRoutingServers,"9a0dc32c-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQInterval1,"8ea825aa-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQInterval2,"99b88f52-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQJournal,"9a0dc321-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQJournalQuota,"9a0dc324-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQLabel,"9a0dc325-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQLabelEx,"4580ad25-d407-48d2-ad24-43e6e56793d7","AD Attribute" +mSMQLongLived,"9a0dc335-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQMigrated,"9a0dc33f-c100-11d1-bbc5-0080c76670c0","AD Attribute" +"MSMQ-MulticastAddress","1d2f4412-f10d-4337-9b48-6e5b125cd265","AD Attribute" +mSMQNameStyle,"9a0dc333-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQNt4Flags,"eb38a158-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQNt4Stub,"6f914be6-d57e-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQOSType,"9a0dc330-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQOutRoutingServers,"9a0dc32b-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQOwnerID,"9a0dc328-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQPrevSiteGates,"2df90d75-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQPrivacyLevel,"9a0dc327-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQMID,"9a0dc33e-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQueueJournalQuota,"8e441266-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQQueueNameExt,"2df90d87-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQQueueQuota,"3f6b8e12-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQQueueType,"9a0dc320-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQuota,"9a0dc322-c100-11d1-bbc5-0080c76670c0","AD Attribute" +"msMQ-Recipient-FormatName","3bfe6748-b544-485a-b067-1b310c4334bf","AD Attribute" +mSMQRoutingService,"2df90d81-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQRoutingServices,"2df90d77-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +"MSMQ-SecuredSource","8bf0221b-7a06-4d63-91f0-1499941813d3","AD Attribute" +mSMQServiceType,"9a0dc32d-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQServices,"9a0dc33d-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSignCertificates,"9a0dc33b-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSignCertificatesMig,"3881b8ea-da3b-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQSignKey,"9a0dc332-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSite1,"9a0dc337-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSite2,"9a0dc338-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteForeign,"fd129d8a-d57e-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQSiteGates,"9a0dc339-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteGatesMig,"e2704852-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQSiteID,"9a0dc340-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteName,"ffadb4b2-de39-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQSiteNameEx,"422144fa-c17f-4649-94d6-9731ed2784ed","AD Attribute" +mSMQSites,"9a0dc32a-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQTransactional,"9a0dc329-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQUserSid,"c58aae32-56f9-11d2-90d0-00c04fd91ab1","AD Attribute" +mSMQVersion,"9a0dc336-c100-11d1-bbc5-0080c76670c0","AD Attribute" +msNPAllowDialin,"db0c9085-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPCalledStationID,"db0c9089-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPCallingStationID,"db0c908a-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPSavedCallingStationID,"db0c908e-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSCallbackNumber,"db0c909c-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSFramedIPAddress,"db0c90a4-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSFramedRoute,"db0c90a9-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSServiceType,"db0c90b6-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedCallbackNumber,"db0c90c5-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedFramedIPAddress,"db0c90c6-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedFramedRoute,"db0c90c7-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +mustContain,"bf9679d3-0de6-11d0-a285-00aa003049e2","AD Attribute" +nameServiceFlags,"80212840-4bdc-11d1-a9c4-0000f80367c1","AD Attribute" +nCName,"bf9679d6-0de6-11d0-a285-00aa003049e2","AD Attribute" +nETBIOSName,"bf9679d8-0de6-11d0-a285-00aa003049e2","AD Attribute" +netbootAllowNewClients,"07383076-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootAnswerOnlyValidClients,"0738307b-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootAnswerRequests,"0738307a-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootCurrentClientCount,"07383079-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootGUID,"3e978921-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootDUID,"532570bd-3d77-424f-822f-0d636dc6daad","AD Attribute" +netbootInitialization,"3e978920-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootIntelliMirrorOSes,"0738307e-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootLimitClients,"07383077-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootLocallyInstalledOSes,"07383080-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootMachineFilePath,"3e978923-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootMaxClients,"07383078-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootMirrorDataFile,"2df90d85-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +netbootNewMachineNamingPolicy,"0738307c-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootNewMachineOU,"0738307d-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootSCPBL,"07383082-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootServer,"07383081-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootSIFFile,"2df90d84-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +netbootTools,"0738307f-91df-11d1-aebc-0000f80367c1","AD Attribute" +networkAddress,"bf9679d9-0de6-11d0-a285-00aa003049e2","AD Attribute" +nextLevelStore,"bf9679da-0de6-11d0-a285-00aa003049e2","AD Attribute" +nextRid,"bf9679db-0de6-11d0-a285-00aa003049e2","AD Attribute" +nonSecurityMember,"52458018-ca6a-11d0-afff-0000f80367c1","AD Attribute" +nonSecurityMemberBL,"52458019-ca6a-11d0-afff-0000f80367c1","AD Attribute" +notificationList,"19195a56-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +nTGroupMembers,"bf9679df-0de6-11d0-a285-00aa003049e2","AD Attribute" +nTMixedDomain,"3e97891f-8c01-11d0-afda-00c04fd930c9","AD Attribute" +ntPwdHistory,"bf9679e2-0de6-11d0-a285-00aa003049e2","AD Attribute" +nTSecurityDescriptor,"bf9679e3-0de6-11d0-a285-00aa003049e2","AD Attribute" +distinguishedName,"bf9679e4-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectCategory,"26d97369-6070-11d1-a9c6-0000f80367c1","AD Attribute" +objectClass,"bf9679e5-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectClassCategory,"bf9679e6-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectClasses,"9a7ad94b-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +objectCount,"34aaa216-b699-11d0-afee-0000f80367c1","AD Attribute" +objectGUID,"bf9679e7-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectSid,"bf9679e8-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectVersion,"16775848-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +oEMInformation,"bf9679ea-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMObjectClass,"bf9679ec-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMSyntax,"bf9679ed-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMTGuid,"ddac0cf3-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +oMTIndxGuid,"1f0075fa-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +operatingSystem,"3e978925-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatingSystemHotfix,"bd951b3c-9c96-11d0-afdd-00c04fd930c9","AD Attribute" +operatingSystemServicePack,"3e978927-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatingSystemVersion,"3e978926-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatorCount,"bf9679ee-0de6-11d0-a285-00aa003049e2","AD Attribute" +optionDescription,"963d274d-48be-11d1-a9c3-0000f80367c1","AD Attribute" +options,"19195a53-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +optionsLocation,"963d274e-48be-11d1-a9c3-0000f80367c1","AD Attribute" +o,"bf9679ef-0de6-11d0-a285-00aa003049e2","AD Attribute" +ou,"bf9679f0-0de6-11d0-a285-00aa003049e2","AD Attribute" +organizationalStatus,"28596019-7349-4d2f-adff-5a629961f942","AD Attribute" +originalDisplayTable,"5fd424ce-1262-11d0-a060-00aa006c33ed","AD Attribute" +originalDisplayTableMSDOS,"5fd424cf-1262-11d0-a060-00aa006c33ed","AD Attribute" +otherLoginWorkstations,"bf9679f1-0de6-11d0-a285-00aa003049e2","AD Attribute" +otherMailbox,"0296c123-40da-11d1-a9c0-0000f80367c1","AD Attribute" +middleName,"bf9679f2-0de6-11d0-a285-00aa003049e2","AD Attribute" +otherWellKnownObjects,"1ea64e5d-ac0f-11d2-90df-00c04fd91ab1","AD Attribute" +owner,"bf9679f3-0de6-11d0-a285-00aa003049e2","AD Attribute" +packageFlags,"7d6c0e99-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +packageName,"7d6c0e98-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +packageType,"7d6c0e96-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +parentCA,"5245801b-ca6a-11d0-afff-0000f80367c1","AD Attribute" +parentCACertificateChain,"963d2733-48be-11d1-a9c3-0000f80367c1","AD Attribute" +parentGUID,"2df90d74-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +partialAttributeDeletionList,"28630ec0-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +partialAttributeSet,"19405b9e-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +pekKeyChangeInterval,"07383084-91df-11d1-aebc-0000f80367c1","AD Attribute" +pekList,"07383083-91df-11d1-aebc-0000f80367c1","AD Attribute" +pendingCACertificates,"963d273c-48be-11d1-a9c3-0000f80367c1","AD Attribute" +pendingParentCA,"963d273e-48be-11d1-a9c3-0000f80367c1","AD Attribute" +perMsgDialogDisplayTable,"5fd424d3-1262-11d0-a060-00aa006c33ed","AD Attribute" +perRecipDialogDisplayTable,"5fd424d4-1262-11d0-a060-00aa006c33ed","AD Attribute" +personalTitle,"16775858-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +otherFacsimileTelephoneNumber,"0296c11d-40da-11d1-a9c0-0000f80367c1","AD Attribute" +otherHomePhone,"f0f8ffa2-1191-11d0-a060-00aa006c33ed","AD Attribute" +homePhone,"f0f8ffa1-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherIpPhone,"4d146e4b-48d4-11d1-a9c3-0000f80367c1","AD Attribute" +ipPhone,"4d146e4a-48d4-11d1-a9c3-0000f80367c1","AD Attribute" +primaryInternationalISDNNumber,"0296c11f-40da-11d1-a9c0-0000f80367c1","AD Attribute" +otherMobile,"0296c11e-40da-11d1-a9c0-0000f80367c1","AD Attribute" +mobile,"f0f8ffa3-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherTelephone,"f0f8ffa5-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherPager,"f0f8ffa4-1191-11d0-a060-00aa006c33ed","AD Attribute" +pager,"f0f8ffa6-1191-11d0-a060-00aa006c33ed","AD Attribute" +photo,"9c979768-ba1a-4c08-9632-c6a5c1ed649a","AD Attribute" +physicalDeliveryOfficeName,"bf9679f7-0de6-11d0-a285-00aa003049e2","AD Attribute" +physicalLocationObject,"b7b13119-b82e-11d0-afee-0000f80367c1","AD Attribute" +thumbnailPhoto,"8d3bca50-1d7e-11d0-a081-00aa006c33ed","AD Attribute" +pKICriticalExtensions,"fc5a9106-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIDefaultCSPs,"1ef6336e-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIDefaultKeySpec,"426cae6e-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIEnrollmentAccess,"926be278-56f9-11d2-90d0-00c04fd91ab1","AD Attribute" +pKIExpirationPeriod,"041570d2-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIExtendedKeyUsage,"18976af6-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIKeyUsage,"e9b0a87e-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIMaxIssuingDepth,"f0bfdefa-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIOverlapPeriod,"1219a3ec-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKT,"8447f9f1-1027-11d0-a05f-00aa006c33ed","AD Attribute" +pKTGuid,"8447f9f0-1027-11d0-a05f-00aa006c33ed","AD Attribute" +policyReplicationFlags,"19405b96-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +portName,"281416c4-1968-11d0-a28f-00aa003049e2","AD Attribute" +possSuperiors,"bf9679fa-0de6-11d0-a285-00aa003049e2","AD Attribute" +possibleInferiors,"9a7ad94c-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +postOfficeBox,"bf9679fb-0de6-11d0-a285-00aa003049e2","AD Attribute" +postalAddress,"bf9679fc-0de6-11d0-a285-00aa003049e2","AD Attribute" +postalCode,"bf9679fd-0de6-11d0-a285-00aa003049e2","AD Attribute" +preferredDeliveryMethod,"bf9679fe-0de6-11d0-a285-00aa003049e2","AD Attribute" +preferredLanguage,"856be0d0-18e7-46e1-8f5f-7ee4d9020e0d","AD Attribute" +preferredOU,"bf9679ff-0de6-11d0-a285-00aa003049e2","AD Attribute" +prefixMap,"52458022-ca6a-11d0-afff-0000f80367c1","AD Attribute" +presentationAddress,"a8df744b-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +previousCACertificates,"963d2739-48be-11d1-a9c3-0000f80367c1","AD Attribute" +previousParentCA,"963d273d-48be-11d1-a9c3-0000f80367c1","AD Attribute" +primaryGroupID,"bf967a00-0de6-11d0-a285-00aa003049e2","AD Attribute" +primaryGroupToken,"c0ed8738-7efd-4481-84d9-66d2db8be369","AD Attribute" +printAttributes,"281416d7-1968-11d0-a28f-00aa003049e2","AD Attribute" +printBinNames,"281416cd-1968-11d0-a28f-00aa003049e2","AD Attribute" +printCollate,"281416d2-1968-11d0-a28f-00aa003049e2","AD Attribute" +printColor,"281416d3-1968-11d0-a28f-00aa003049e2","AD Attribute" +printDuplexSupported,"281416cc-1968-11d0-a28f-00aa003049e2","AD Attribute" +printEndTime,"281416ca-1968-11d0-a28f-00aa003049e2","AD Attribute" +printFormName,"281416cb-1968-11d0-a28f-00aa003049e2","AD Attribute" +printKeepPrintedJobs,"ba305f6d-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printLanguage,"281416d6-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMACAddress,"ba305f7a-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMaxCopies,"281416d1-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMaxResolutionSupported,"281416cf-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMaxXExtent,"ba305f6f-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMaxYExtent,"ba305f70-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMediaReady,"3bcbfcf5-4d3d-11d0-a1a6-00c04fd930c9","AD Attribute" +printMediaSupported,"244b296f-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +printMemory,"ba305f74-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMinXExtent,"ba305f71-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMinYExtent,"ba305f72-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNetworkAddress,"ba305f79-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNotify,"ba305f6a-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNumberUp,"3bcbfcf4-4d3d-11d0-a1a6-00c04fd930c9","AD Attribute" +printOrientationsSupported,"281416d0-1968-11d0-a28f-00aa003049e2","AD Attribute" +printOwner,"ba305f69-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printPagesPerMinute,"19405b97-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +printRate,"ba305f77-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printRateUnit,"ba305f78-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printSeparatorFile,"281416c6-1968-11d0-a28f-00aa003049e2","AD Attribute" +printShareName,"ba305f68-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printSpooling,"ba305f6c-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printStaplingSupported,"ba305f73-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printStartTime,"281416c9-1968-11d0-a28f-00aa003049e2","AD Attribute" +printStatus,"ba305f6b-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printerName,"244b296e-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +priorSetTime,"bf967a01-0de6-11d0-a285-00aa003049e2","AD Attribute" +priorValue,"bf967a02-0de6-11d0-a285-00aa003049e2","AD Attribute" +priority,"281416c7-1968-11d0-a28f-00aa003049e2","AD Attribute" +privateKey,"bf967a03-0de6-11d0-a285-00aa003049e2","AD Attribute" +privilegeAttributes,"19405b9a-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeDisplayName,"19405b98-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeHolder,"19405b9b-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeValue,"19405b99-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +productCode,"d9e18317-8939-11d1-aebc-0000f80367c1","AD Attribute" +profilePath,"bf967a05-0de6-11d0-a285-00aa003049e2","AD Attribute" +proxiedObjectName,"e1aea402-cd5b-11d0-afff-0000f80367c1","AD Attribute" +proxyAddresses,"bf967a06-0de6-11d0-a285-00aa003049e2","AD Attribute" +proxyGenerationEnabled,"5fd424d6-1262-11d0-a060-00aa006c33ed","AD Attribute" +proxyLifetime,"bf967a07-0de6-11d0-a285-00aa003049e2","AD Attribute" +publicKeyPolicy,"80a67e28-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +purportedSearch,"b4b54e50-943a-11d1-aebd-0000f80367c1","AD Attribute" +pwdHistoryLength,"bf967a09-0de6-11d0-a285-00aa003049e2","AD Attribute" +pwdLastSet,"bf967a0a-0de6-11d0-a285-00aa003049e2","AD Attribute" +pwdProperties,"bf967a0b-0de6-11d0-a285-00aa003049e2","AD Attribute" +qualityOfService,"80a67e4e-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +queryFilter,"cbf70a26-7e78-11d2-9921-0000f87a57d4","AD Attribute" +queryPolicyBL,"e1aea404-cd5b-11d0-afff-0000f80367c1","AD Attribute" +queryPolicyObject,"e1aea403-cd5b-11d0-afff-0000f80367c1","AD Attribute" +queryPoint,"7bfdcb86-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rangeLower,"bf967a0c-0de6-11d0-a285-00aa003049e2","AD Attribute" +rangeUpper,"bf967a0d-0de6-11d0-a285-00aa003049e2","AD Attribute" +name,"bf967a0e-0de6-11d0-a285-00aa003049e2","AD Attribute" +rDNAttID,"bf967a0f-0de6-11d0-a285-00aa003049e2","AD Attribute" +registeredAddress,"bf967a10-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteServerName,"bf967a12-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteSource,"bf967a14-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteSourceType,"bf967a15-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteStorageGUID,"2a39c5b0-8960-11d1-aebc-0000f80367c1","AD Attribute" +replPropertyMetaData,"281416c0-1968-11d0-a28f-00aa003049e2","AD Attribute" +replTopologyStayOfExecution,"7bfdcb83-4807-11d1-a9c3-0000f80367c1","AD Attribute" +replUpToDateVector,"bf967a16-0de6-11d0-a285-00aa003049e2","AD Attribute" +replicaSource,"bf967a18-0de6-11d0-a285-00aa003049e2","AD Attribute" +directReports,"bf967a1c-0de6-11d0-a285-00aa003049e2","AD Attribute" +replInterval,"45ba9d1a-56fa-11d2-90d0-00c04fd91ab1","AD Attribute" +repsFrom,"bf967a1d-0de6-11d0-a285-00aa003049e2","AD Attribute" +repsTo,"bf967a1e-0de6-11d0-a285-00aa003049e2","AD Attribute" +requiredCategories,"7d6c0e93-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +retiredReplDSASignatures,"7bfdcb7f-4807-11d1-a9c3-0000f80367c1","AD Attribute" +tokenGroups,"b7c69e6d-2cc7-11d2-854e-00a0c983f608","AD Attribute" +tokenGroupsGlobalAndUniversal,"46a9b11d-60ae-405a-b7e8-ff8a58d456d2","AD Attribute" +tokenGroupsNoGCAcceptable,"040fc392-33df-11d2-98b2-0000f87a57d4","AD Attribute" +revision,"bf967a21-0de6-11d0-a285-00aa003049e2","AD Attribute" +rid,"bf967a22-0de6-11d0-a285-00aa003049e2","AD Attribute" +rIDAllocationPool,"66171889-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDAvailablePool,"66171888-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDManagerReference,"66171886-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDNextRID,"6617188c-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDPreviousAllocationPool,"6617188a-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDSetReferences,"7bfdcb7b-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rIDUsedPool,"6617188b-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rightsGuid,"8297931c-86d3-11d0-afda-00c04fd930c9","AD Attribute" +roleOccupant,"a8df7465-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +roomNumber,"81d7f8c2-e327-4a0d-91c6-b42d4009115f","AD Attribute" +rootTrust,"7bfdcb80-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rpcNsAnnotation,"88611bde-8cf4-11d0-afda-00c04fd930c9","AD Attribute" +rpcNsBindings,"bf967a23-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsCodeset,"7a0ba0e0-8e98-11d0-afda-00c04fd930c9","AD Attribute" +rpcNsEntryFlags,"80212841-4bdc-11d1-a9c4-0000f80367c1","AD Attribute" +rpcNsGroup,"bf967a24-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsInterfaceID,"bf967a25-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsObjectID,"29401c48-7a27-11d0-afd6-00c04fd930c9","AD Attribute" +rpcNsPriority,"bf967a27-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsProfileEntry,"bf967a28-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsTransferSyntax,"29401c4a-7a27-11d0-afd6-00c04fd930c9","AD Attribute" +sAMAccountName,"3e0abfd0-126a-11d0-a060-00aa006c33ed","AD Attribute" +sAMAccountType,"6e7b626c-64f2-11d0-afd2-00c04fd930c9","AD Attribute" +samDomainUpdates,"04d2d114-f799-4e9b-bcdc-90e8f5ba7ebe","AD Attribute" +schedule,"dd712224-10e4-11d0-a05f-00aa006c33ed","AD Attribute" +schemaFlagsEx,"bf967a2b-0de6-11d0-a285-00aa003049e2","AD Attribute" +schemaIDGUID,"bf967923-0de6-11d0-a285-00aa003049e2","AD Attribute" +schemaInfo,"f9fb64ae-93b4-11d2-9945-0000f87a57d4","AD Attribute" +schemaUpdate,"1e2d06b4-ac8f-11d0-afe3-00c04fd930c9","AD Attribute" +schemaVersion,"bf967a2c-0de6-11d0-a285-00aa003049e2","AD Attribute" +scopeFlags,"16f3a4c2-7e79-11d2-9921-0000f87a57d4","AD Attribute" +scriptPath,"bf9679a8-0de6-11d0-a285-00aa003049e2","AD Attribute" +sDRightsEffective,"c3dbafa6-33df-11d2-98b2-0000f87a57d4","AD Attribute" +searchFlags,"bf967a2d-0de6-11d0-a285-00aa003049e2","AD Attribute" +searchGuide,"bf967a2e-0de6-11d0-a285-00aa003049e2","AD Attribute" +secretary,"01072d9a-98ad-4a53-9744-e83e287278fb","AD Attribute" +securityIdentifier,"bf967a2f-0de6-11d0-a285-00aa003049e2","AD Attribute" +seeAlso,"bf967a31-0de6-11d0-a285-00aa003049e2","AD Attribute" +seqNotification,"ddac0cf2-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +serialNumber,"bf967a32-0de6-11d0-a285-00aa003049e2","AD Attribute" +serverName,"09dcb7a0-165f-11d0-a064-00aa006c33ed","AD Attribute" +serverReference,"26d9736d-6070-11d1-a9c6-0000f80367c1","AD Attribute" +serverReferenceBL,"26d9736e-6070-11d1-a9c6-0000f80367c1","AD Attribute" +serverRole,"bf967a33-0de6-11d0-a285-00aa003049e2","AD Attribute" +serverState,"bf967a34-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceBindingInformation,"b7b1311c-b82e-11d0-afee-0000f80367c1","AD Attribute" +serviceClassID,"bf967a35-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceClassInfo,"bf967a36-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceClassName,"b7b1311d-b82e-11d0-afee-0000f80367c1","AD Attribute" +serviceDNSName,"28630eb8-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +serviceDNSNameType,"28630eba-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +serviceInstanceVersion,"bf967a37-0de6-11d0-a285-00aa003049e2","AD Attribute" +servicePrincipalName,"f3a64788-5306-11d1-a9c5-0000f80367c1","AD Attribute" +setupCommand,"7d6c0e97-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +shellContextMenu,"553fd039-f32e-11d0-b0bc-00c04fd8dca6","AD Attribute" +shellPropertyPages,"52458039-ca6a-11d0-afff-0000f80367c1","AD Attribute" +shortServerName,"45b01501-c419-11d1-bbc9-0080c76670c0","AD Attribute" +showInAddressBook,"3e74f60e-3e73-11d1-a9c0-0000f80367c1","AD Attribute" +showInAdvancedViewOnly,"bf967984-0de6-11d0-a285-00aa003049e2","AD Attribute" +sIDHistory,"17eb4278-d167-11d0-b002-0000f80367c1","AD Attribute" +signatureAlgorithms,"2a39c5b2-8960-11d1-aebc-0000f80367c1","AD Attribute" +siteGUID,"3e978924-8c01-11d0-afda-00c04fd930c9","AD Attribute" +siteLinkList,"d50c2cdd-8951-11d1-aebc-0000f80367c1","AD Attribute" +siteList,"d50c2cdc-8951-11d1-aebc-0000f80367c1","AD Attribute" +siteObject,"3e10944c-c354-11d0-aff8-0000f80367c1","AD Attribute" +siteObjectBL,"3e10944d-c354-11d0-aff8-0000f80367c1","AD Attribute" +siteServer,"1be8f17c-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +mailAddress,"26d9736f-6070-11d1-a9c6-0000f80367c1","AD Attribute" +sPNMappings,"2ab0e76c-7041-11d2-9905-0000f87a57d4","AD Attribute" +st,"bf967a39-0de6-11d0-a285-00aa003049e2","AD Attribute" +street,"bf967a3a-0de6-11d0-a285-00aa003049e2","AD Attribute" +structuralObjectClass,"3860949f-f6a8-4b38-9950-81ecb6bc2982","AD Attribute" +subClassOf,"bf967a3b-0de6-11d0-a285-00aa003049e2","AD Attribute" +subRefs,"bf967a3c-0de6-11d0-a285-00aa003049e2","AD Attribute" +subSchemaSubEntry,"9a7ad94d-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +superScopeDescription,"963d274c-48be-11d1-a9c3-0000f80367c1","AD Attribute" +superScopes,"963d274b-48be-11d1-a9c3-0000f80367c1","AD Attribute" +superiorDNSRoot,"5245801d-ca6a-11d0-afff-0000f80367c1","AD Attribute" +supplementalCredentials,"bf967a3f-0de6-11d0-a285-00aa003049e2","AD Attribute" +supportedApplicationContext,"1677588f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +sn,"bf967a41-0de6-11d0-a285-00aa003049e2","AD Attribute" +syncAttributes,"037651e4-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncMembership,"037651e3-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncWithObject,"037651e2-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncWithSID,"037651e5-441d-11d1-a9c3-0000f80367c1","AD Attribute" +systemAuxiliaryClass,"bf967a43-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemFlags,"e0fa1e62-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +systemMayContain,"bf967a44-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemMustContain,"bf967a45-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemOnly,"bf967a46-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemPossSuperiors,"bf967a47-0de6-11d0-a285-00aa003049e2","AD Attribute" +telephoneNumber,"bf967a49-0de6-11d0-a285-00aa003049e2","AD Attribute" +teletexTerminalIdentifier,"bf967a4a-0de6-11d0-a285-00aa003049e2","AD Attribute" +telexNumber,"bf967a4b-0de6-11d0-a285-00aa003049e2","AD Attribute" +primaryTelexNumber,"0296c121-40da-11d1-a9c0-0000f80367c1","AD Attribute" +templateRoots,"ed9de9a0-7041-11d2-9905-0000f87a57d4","AD Attribute" +terminalServer,"6db69a1c-9422-11d1-aebd-0000f80367c1","AD Attribute" +co,"f0f8ffa7-1191-11d0-a060-00aa006c33ed","AD Attribute" +textEncodedORAddress,"a8df7489-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +timeRefresh,"ddac0cf1-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +timeVolChange,"ddac0cf0-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +title,"bf967a55-0de6-11d0-a285-00aa003049e2","AD Attribute" +tombstoneLifetime,"16c3a860-1273-11d0-a060-00aa006c33ed","AD Attribute" +transportAddressAttribute,"c1dc867c-a261-11d1-b606-0000f80367c1","AD Attribute" +transportDLLName,"26d97372-6070-11d1-a9c6-0000f80367c1","AD Attribute" +transportType,"26d97374-6070-11d1-a9c6-0000f80367c1","AD Attribute" +treatAsLeaf,"8fd044e3-771f-11d1-aeae-0000f80367c1","AD Attribute" +treeName,"28630ebd-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +trustAttributes,"80a67e5a-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +trustAuthIncoming,"bf967a59-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustAuthOutgoing,"bf967a5f-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustDirection,"bf967a5c-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustParent,"b000ea7a-a086-11d0-afdd-00c04fd930c9","AD Attribute" +trustPartner,"bf967a5d-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustPosixOffset,"bf967a5e-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustType,"bf967a60-0de6-11d0-a285-00aa003049e2","AD Attribute" +uASCompat,"bf967a61-0de6-11d0-a285-00aa003049e2","AD Attribute" +uid,"0bb0fca0-1e89-429f-901a-1413894d9f59","AD Attribute" +uNCName,"bf967a64-0de6-11d0-a285-00aa003049e2","AD Attribute" +unicodePwd,"bf9679e1-0de6-11d0-a285-00aa003049e2","AD Attribute" +uniqueIdentifier,"ba0184c7-38c5-4bed-a526-75421470580c","AD Attribute" +uniqueMember,"8f888726-f80a-44d7-b1ee-cb9df21392c8","AD Attribute" +unstructuredAddress,"50950839-cc4c-4491-863a-fcf942d684b7","AD Attribute" +unstructuredName,"9c8ef177-41cf-45c9-9673-7716c0c8901b","AD Attribute" +upgradeProductCode,"d9e18312-8939-11d1-aebc-0000f80367c1","AD Attribute" +uPNSuffixes,"032160bf-9824-11d1-aec0-0000f80367c1","AD Attribute" +userAccountControl,"bf967a68-0de6-11d0-a285-00aa003049e2","AD Attribute" +userCert,"bf967a69-0de6-11d0-a285-00aa003049e2","AD Attribute" +comment,"bf967a6a-0de6-11d0-a285-00aa003049e2","AD Attribute" +userParameters,"bf967a6d-0de6-11d0-a285-00aa003049e2","AD Attribute" +userPassword,"bf967a6e-0de6-11d0-a285-00aa003049e2","AD Attribute" +userClass,"11732a8a-e14d-4cc5-b92f-d93f51c6d8e4","AD Attribute" +userPKCS12,"23998ab5-70f8-4007-a4c1-a84a38311f9a","AD Attribute" +userPrincipalName,"28630ebb-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +userSharedFolder,"9a9a021f-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +userSharedFolderOther,"9a9a0220-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +userSMIMECertificate,"e16a9db2-403c-11d1-a9c0-0000f80367c1","AD Attribute" +userWorkstations,"bf9679d7-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNChanged,"bf967a6f-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNCreated,"bf967a70-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNDSALastObjRemoved,"bf967a71-0de6-11d0-a285-00aa003049e2","AD Attribute" +USNIntersite,"a8df7498-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +uSNLastObjRem,"bf967a73-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNSource,"167758ad-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +validAccesses,"4d2fa380-7f54-11d2-992a-0000f87a57d4","AD Attribute" +vendor,"281416df-1968-11d0-a28f-00aa003049e2","AD Attribute" +versionNumber,"bf967a76-0de6-11d0-a285-00aa003049e2","AD Attribute" +versionNumberHi,"7d6c0e9a-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +versionNumberLo,"7d6c0e9b-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +volTableGUID,"1f0075fd-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +volTableIdxGUID,"1f0075fb-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +volumeCount,"34aaa217-b699-11d0-afee-0000f80367c1","AD Attribute" +wbemPath,"244b2970-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +wellKnownObjects,"05308983-7688-11d1-aded-00c04fd8d5cd","AD Attribute" +whenChanged,"bf967a77-0de6-11d0-a285-00aa003049e2","AD Attribute" +whenCreated,"bf967a78-0de6-11d0-a285-00aa003049e2","AD Attribute" +winsockAddresses,"bf967a79-0de6-11d0-a285-00aa003049e2","AD Attribute" +wWWHomePage,"bf967a7a-0de6-11d0-a285-00aa003049e2","AD Attribute" +url,"9a9a0221-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +x121Address,"bf967a7b-0de6-11d0-a285-00aa003049e2","AD Attribute" +x500uniqueIdentifier,"d07da11f-8a3d-42b6-b0aa-76c962be719a","AD Attribute" +userCertificate,"bf967a7f-0de6-11d0-a285-00aa003049e2","AD Attribute" +unixUserPassword,"612cb747-c0e8-4f92-9221-fdd5f15b550d","AD Attribute" +uidNumber,"850fcc8f-9c6b-47e1-b671-7c654be4d5b3","AD Attribute" +gidNumber,"c5b95f0c-ec9e-41c4-849c-b46597ed6696","AD Attribute" +gecos,"a3e03f1f-1d55-4253-a0af-30c2a784e46e","AD Attribute" +unixHomeDirectory,"bc2dba12-000f-464d-bf1d-0808465d8843","AD Attribute" +loginShell,"a553d12c-3231-4c5e-8adf-8d189697721e","AD Attribute" +shadowLastChange,"f8f2689c-29e8-4843-8177-e8b98e15eeac","AD Attribute" +shadowMin,"a76b8737-e5a1-4568-b057-dc12e04be4b2","AD Attribute" +shadowMax,"f285c952-50dd-449e-9160-3b880d99988d","AD Attribute" +shadowWarning,"7ae89c9c-2976-4a46-bb8a-340f88560117","AD Attribute" +shadowInactive,"86871d1f-3310-4312-8efd-af49dcfb2671","AD Attribute" +shadowExpire,"75159a00-1fff-4cf4-8bff-4ef2695cf643","AD Attribute" +shadowFlag,"8dfeb70d-c5db-46b6-b15e-a4389e6cee9b","AD Attribute" +memberUid,"03dab236-672e-4f61-ab64-f77d2dc2ffab","AD Attribute" +memberNisNetgroup,"0f6a17dc-53e5-4be8-9442-8f3ce2f9012a","AD Attribute" +nisNetgroupTriple,"a8032e74-30ef-4ff5-affc-0fc217783fec","AD Attribute" +ipServicePort,"ff2daebf-f463-495a-8405-3e483641eaa2","AD Attribute" +ipServiceProtocol,"cd96ec0b-1ed6-43b4-b26b-f170b645883f","AD Attribute" +ipProtocolNumber,"ebf5c6eb-0e2d-4415-9670-1081993b4211","AD Attribute" +oncRpcNumber,"966825f5-01d9-4a5c-a011-d15ae84efa55","AD Attribute" +ipHostNumber,"de8bb721-85dc-4fde-b687-9657688e667e","AD Attribute" +ipNetworkNumber,"4e3854f4-3087-42a4-a813-bb0c528958d3","AD Attribute" +ipNetmaskNumber,"6ff64fcd-462e-4f62-b44a-9a5347659eb9","AD Attribute" +macAddress,"e6a522dd-9770-43e1-89de-1de5044328f7","AD Attribute" +bootParameter,"d72a0750-8c7c-416e-8714-e65f11e908be","AD Attribute" +bootFile,"e3f3cb4e-0f20-42eb-9703-d2ff26e52667","AD Attribute" +nisMapName,"969d3c79-0e9a-4d95-b0ac-bdde7ff8f3a1","AD Attribute" +nisMapEntry,"4a95216e-fcc0-402e-b57f-5971626148a9","AD Attribute" +msSFU30SearchContainer,"27eebfa2-fbeb-4f8e-aad6-c50247994291","AD Attribute" +msSFU30KeyAttributes,"32ecd698-ce9e-4894-a134-7ad76b082e83","AD Attribute" +msSFU30FieldSeparator,"a2e11a42-e781-4ca1-a7fa-ec307f62b6a1","AD Attribute" +msSFU30IntraFieldSeparator,"95b2aef0-27e4-4cb9-880a-a2d9a9ea23b8","AD Attribute" +msSFU30SearchAttributes,"ef9a2df0-2e57-48c8-8950-0cc674004733","AD Attribute" +msSFU30ResultAttributes,"e167b0b6-4045-4433-ac35-53f972d45cba","AD Attribute" +msSFU30MapFilter,"b7b16e01-024f-4e23-ad0d-71f1a406b684","AD Attribute" +msSFU30MasterServerName,"4cc908a2-9e18-410e-8459-f17cc422020a","AD Attribute" +msSFU30OrderNumber,"02625f05-d1ee-4f9f-b366-55266becb95c","AD Attribute" +msSFU30Name,"16c5d1d3-35c2-4061-a870-a5cefda804f0","AD Attribute" +msSFU30Aliases,"20ebf171-c69a-4c31-b29d-dcb837d8912d","AD Attribute" +msSFU30KeyValues,"37830235-e5e9-46f2-922b-d8d44f03e7ae","AD Attribute" +msSFU30NisDomain,"9ee3b2e3-c7f3-45f8-8c9f-1382be4984d2","AD Attribute" +msSFU30Domains,"93095ed3-6f30-4bdd-b734-65d569f5f7c9","AD Attribute" +msSFU30YpServers,"084a944b-e150-4bfe-9345-40e1aedaebba","AD Attribute" +msSFU30MaxGidNumber,"04ee6aa6-f83b-469a-bf5a-3c00d3634669","AD Attribute" +msSFU30MaxUidNumber,"ec998437-d944-4a28-8500-217588adfc75","AD Attribute" +msSFU30NSMAPFieldPosition,"585c9d5e-f599-4f07-9cf9-4373af4b89d3","AD Attribute" +msSFU30PosixMember,"c875d82d-2848-4cec-bb50-3c5486d09d57","AD Attribute" +msSFU30PosixMemberOf,"7bd76b92-3244-438a-ada6-24f5ea34381e","AD Attribute" +msSFU30NetgroupHostAtDomain,"97d2bf65-0466-4852-a25a-ec20f57ee36c","AD Attribute" +msSFU30NetgroupUserAtDomain,"a9e84eed-e630-4b67-b4b3-cad2a82d345e","AD Attribute" +msSFU30IsValidContainer,"0dea42f5-278d-4157-b4a7-49b59664915b","AD Attribute" +msSFU30CryptMethod,"4503d2a3-3d70-41b8-b077-dff123c15865","AD Attribute" +msTSProfilePath,"e65c30db-316c-4060-a3a0-387b083f09cd","AD Attribute" +msTSHomeDirectory,"5d3510f0-c4e7-4122-b91f-a20add90e246","AD Attribute" +msTSHomeDrive,"5f0a24d9-dffa-4cd9-acbf-a0680c03731e","AD Attribute" +msTSAllowLogon,"3a0cd464-bc54-40e7-93ae-a646a6ecc4b4","AD Attribute" +msTSRemoteControl,"15177226-8642-468b-8c48-03ddfd004982","AD Attribute" +msTSMaxDisconnectionTime,"326f7089-53d8-4784-b814-46d8535110d2","AD Attribute" +msTSMaxConnectionTime,"1d960ee2-6464-4e95-a781-e3b5cd5f9588","AD Attribute" +msTSMaxIdleTime,"ff739e9c-6bb7-460e-b221-e250f3de0f95","AD Attribute" +msTSReconnectionAction,"366ed7ca-3e18-4c7f-abae-351a01e4b4f7","AD Attribute" +msTSBrokenConnectionAction,"1cf41bba-5604-463e-94d6-1a1287b72ca3","AD Attribute" +msTSConnectClientDrives,"23572aaf-29dd-44ea-b0fa-7e8438b9a4a3","AD Attribute" +msTSConnectPrinterDrives,"8ce6a937-871b-4c92-b285-d99d4036681c","AD Attribute" +msTSDefaultToMainPrinter,"c0ffe2bd-cacf-4dc7-88d5-61e9e95766f6","AD Attribute" +msTSWorkDirectory,"a744f666-3d3c-4cc8-834b-9d4f6f687b8b","AD Attribute" +msTSInitialProgram,"9201ac6f-1d69-4dfb-802e-d95510109599","AD Attribute" +msTSEndpointData,"40e1c407-4344-40f3-ab43-3625a34a63a2","AD Attribute" +msTSEndpointType,"377ade80-e2d8-46c5-9bcd-6d9dec93b35e","AD Attribute" +msTSEndpointPlugin,"3c08b569-801f-4158-b17b-e363d6ae696a","AD Attribute" +msTSPrimaryDesktop,"29259694-09e4-4237-9f72-9306ebe63ab2","AD Attribute" +msTSSecondaryDesktops,"f63aa29a-bb31-48e1-bfab-0a6c5a1d39c2","AD Attribute" +msTSPrimaryDesktopBL,"9daadc18-40d1-4ed1-a2bf-6b9bf47d3daa","AD Attribute" +msTSSecondaryDesktopBL,"34b107af-a00a-455a-b139-dd1a1b12d8af","AD Attribute" +msTSProperty01,"faaea977-9655-49d7-853d-f27bb7aaca0f","AD Attribute" +msTSProperty02,"3586f6ac-51b7-4978-ab42-f936463198e7","AD Attribute" +msTSExpireDate,"70004ef5-25c3-446a-97c8-996ae8566776","AD Attribute" +msTSExpireDate2,"54dfcf71-bc3f-4f0b-9d5a-4b2476bb8925","AD Attribute" +msTSExpireDate3,"41bc7f04-be72-4930-bd10-1f3439412387","AD Attribute" +msTSExpireDate4,"5e11dc43-204a-4faf-a008-6863621c6f5f","AD Attribute" +msTSLicenseVersion,"0ae94a89-372f-4df2-ae8a-c64a2bc47278","AD Attribute" +msTSLicenseVersion2,"4b0df103-8d97-45d9-ad69-85c3080ba4e7","AD Attribute" +msTSLicenseVersion3,"f8ba8f81-4cab-4973-a3c8-3a6da62a5e31","AD Attribute" +msTSLicenseVersion4,"70ca5d97-2304-490a-8a27-52678c8d2095","AD Attribute" +msTSManagingLS,"f3bcc547-85b0-432c-9ac0-304506bf2c83","AD Attribute" +msTSManagingLS2,"349f0757-51bd-4fc8-9d66-3eceea8a25be","AD Attribute" +msTSManagingLS3,"fad5dcc1-2130-4c87-a118-75322cd67050","AD Attribute" +msTSManagingLS4,"f7a3b6a0-2107-4140-b306-75cb521731e5","AD Attribute" +msTSLSProperty01,"87e53590-971d-4a52-955b-4794d15a84ae","AD Attribute" +msTSLSProperty02,"47c77bb0-316e-4e2f-97f1-0d4c48fca9dd","AD Attribute" +"msDFSR-DisablePacketPrivacy","6a84ede5-741e-43fd-9dd6-aa0f61578621","AD Attribute" +"msDFSR-DefaultCompressionExclusionFilter","87811bd5-cd8b-45cb-9f5d-980f3a9e0c97","AD Attribute" +"msDFSR-OnDemandExclusionFileFilter","a68359dc-a581-4ee6-9015-5382c60f0fb4","AD Attribute" +"msDFSR-OnDemandExclusionDirectoryFilter","7d523aff-9012-49b2-9925-f922a0018656","AD Attribute" +"msDFSR-Options2","11e24318-4ca6-4f49-9afe-e5eb1afa3473","AD Attribute" +"msDFSR-CommonStagingPath","936eac41-d257-4bb9-bd55-f310a3cf09ad","AD Attribute" +"msDFSR-CommonStagingSizeInMb","135eb00e-4846-458b-8ea2-a37559afd405","AD Attribute" +"msDFSR-StagingCleanupTriggerInPercent","d64b9c23-e1fa-467b-b317-6964d744d633","AD Attribute" +"msDFS-Commentv2","b786cec9-61fd-4523-b2c1-5ceb3860bb32","AD Attribute" +"msDFS-GenerationGUIDv2","35b8b3d9-c58f-43d6-930e-5040f2f1a781","AD Attribute" +"msDFS-LastModifiedv2","3c095e8a-314e-465b-83f5-ab8277bcf29b","AD Attribute" +"msDFS-LinkIdentityGUIDv2","edb027f3-5726-4dee-8d4e-dbf07e1ad1f1","AD Attribute" +"msDFS-LinkPathv2","86b021f6-10ab-40a2-a252-1dc0cc3be6a9","AD Attribute" +"msDFS-LinkSecurityDescriptorv2","57cf87f7-3426-4841-b322-02b3b6e9eba8","AD Attribute" +"msDFS-NamespaceIdentityGUIDv2","200432ce-ec5f-4931-a525-d7f4afe34e68","AD Attribute" +"msDFS-Propertiesv2","0c3e5bc5-eb0e-40f5-9b53-334e958dffdb","AD Attribute" +"msDFS-SchemaMajorVersion","ec6d7855-704a-4f61-9aa6-c49a7c1d54c7","AD Attribute" +"msDFS-SchemaMinorVersion","fef9a725-e8f1-43ab-bd86-6a0115ce9e38","AD Attribute" +"msDFS-ShortNameLinkPathv2","2d7826f0-4cf7-42e9-a039-1110e0d9ca99","AD Attribute" +"msDFS-TargetListv2","6ab126c6-fa41-4b36-809e-7ca91610d48f","AD Attribute" +"msDFS-Ttlv2","ea944d31-864a-4349-ada5-062e2c614f5e","AD Attribute" +"msDS-BridgeHeadServersUsed","3ced1465-7b71-2541-8780-1e1ea6243a82","AD Attribute" +"msDS-IsUsedAsResourceSecurityAttribute","51c9f89d-4730-468d-a2b5-1d493212d17e","AD Attribute" +"msDS-ClaimPossibleValues","2e28edee-ed7c-453f-afe4-93bd86f2174f","AD Attribute" +"msDS-ClaimValueType","c66217b9-e48e-47f7-b7d5-6552b8afd619","AD Attribute" +"msDS-ClaimAttributeSource","eebc123e-bae6-4166-9e5b-29884a8b76b0","AD Attribute" +"msDS-ClaimTypeAppliesToClass","6afb0e4c-d876-437c-aeb6-c3e41454c272","AD Attribute" +"msDS-ClaimSharesPossibleValuesWith","52c8d13a-ce0b-4f57-892b-18f5a43a2400","AD Attribute" +"msDS-ClaimSharesPossibleValuesWithBL","54d522db-ec95-48f5-9bbd-1880ebbb2180","AD Attribute" +"msDS-MembersOfResourcePropertyList","4d371c11-4cad-4c41-8ad2-b180ab2bd13c","AD Attribute" +"msDS-MembersOfResourcePropertyListBL","7469b704-edb0-4568-a5a5-59f4862c75a7","AD Attribute" +"msSPP-CSVLKPid","b47f510d-6b50-47e1-b556-772c79e4ffc4","AD Attribute" +"msSPP-CSVLKPartialProductKey","a601b091-8652-453a-b386-87ad239b7c08","AD Attribute" +"msSPP-CSVLKSkuId","9684f739-7b78-476d-8d74-31ad7692eef4","AD Attribute" +"msSPP-KMSIds","9b663eda-3542-46d6-9df0-314025af2bac","AD Attribute" +"msSPP-InstallationId","69bfb114-407b-4739-a213-c663802b3e37","AD Attribute" +"msSPP-ConfirmationId","6e8797c4-acda-4a49-8740-b0bd05a9b831","AD Attribute" +"msSPP-OnlineLicense","098f368e-4812-48cd-afb7-a136b96807ed","AD Attribute" +"msSPP-PhoneLicense","67e4d912-f362-4052-8c79-42f45ba7b221","AD Attribute" +"msSPP-ConfigLicense","0353c4b5-d199-40b0-b3c5-deb32fd9ec06","AD Attribute" +"msSPP-IssuanceLicense","1075b3a1-bbaf-49d2-ae8d-c4f25c823303","AD Attribute" +"msTPM-SrkPubThumbprint","19d706eb-4d76-44a2-85d6-1c342be3be37","AD Attribute" +"msTPM-OwnerInformationTemp","c894809d-b513-4ff8-8811-f4f43f5ac7bc","AD Attribute" +"msTPM-TpmInformationForComputer","ea1b7b93-5e48-46d5-bc6c-4df4fda78a35","AD Attribute" +"msTPM-TpmInformationForComputerBL","14fa84c9-8ecd-4348-bc91-6d3ced472ab7","AD Attribute" +"msDNS-KeymasterZones","0be0dd3b-041a-418c-ace9-2f17d23e9d42","AD Attribute" +"msDNS-IsSigned","aa12854c-d8fc-4d5e-91ca-368b8d829bee","AD Attribute" +"msDNS-SignWithNSEC3","c79f2199-6da1-46ff-923c-1f3f800c721e","AD Attribute" +"msDNS-NSEC3OptOut","7bea2088-8ce2-423c-b191-66ec506b1595","AD Attribute" +"msDNS-MaintainTrustAnchor","0dc063c1-52d9-4456-9e15-9c2434aafd94","AD Attribute" +"msDNS-DSRecordAlgorithms","5c5b7ad2-20fa-44bb-beb3-34b9c0f65579","AD Attribute" +"msDNS-RFC5011KeyRollovers","27d93c40-065a-43c0-bdd8-cdf2c7d120aa","AD Attribute" +"msDNS-NSEC3HashAlgorithm","ff9e5552-7db7-4138-8888-05ce320a0323","AD Attribute" +"msDNS-NSEC3RandomSaltLength","13361665-916c-4de7-a59d-b1ebbd0de129","AD Attribute" +"msDNS-NSEC3Iterations","80b70aab-8959-4ec0-8e93-126e76df3aca","AD Attribute" +"msDNS-DNSKEYRecordSetTTL","8f4e317f-28d7-442c-a6df-1f491f97b326","AD Attribute" +"msDNS-DSRecordSetTTL","29869b7c-64c4-42fe-97d5-fbc2fa124160","AD Attribute" +"msDNS-SignatureInceptionOffset","03d4c32e-e217-4a61-9699-7bbc4729a026","AD Attribute" +"msDNS-SecureDelegationPollingPeriod","f6b0f0be-a8e4-4468-8fd9-c3c47b8722f9","AD Attribute" +"msDNS-SigningKeyDescriptors","3443d8cd-e5b6-4f3b-b098-659a0214a079","AD Attribute" +"msDNS-SigningKeys","b7673e6d-cad9-4e9e-b31a-63e8098fdd63","AD Attribute" +"msDNS-DNSKEYRecords","28c458f5-602d-4ac9-a77c-b3f1be503a7e","AD Attribute" +"msDNS-ParentHasSecureDelegation","285c6964-c11a-499e-96d8-bf7c75a223c6","AD Attribute" +"msDNS-PropagationTime","ba340d47-2181-4ca0-a2f6-fae4479dab2a","AD Attribute" +"msDNS-NSEC3UserSalt","aff16770-9622-4fbc-a128-3088777605b9","AD Attribute" +"msDNS-NSEC3CurrentSalt","387d9432-a6d1-4474-82cd-0a89aae084ae","AD Attribute" +"msAuthz-EffectiveSecurityPolicy","07831919-8f94-4fb6-8a42-91545dccdad3","AD Attribute" +"msAuthz-ProposedSecurityPolicy","b946bece-09b5-4b6a-b25a-4b63a330e80e","AD Attribute" +"msAuthz-LastEffectiveSecurityPolicy","8e1685c6-3e2f-48a2-a58d-5af0ea789fa0","AD Attribute" +"msAuthz-ResourceCondition","80997877-f874-4c68-864d-6e508a83bdbd","AD Attribute" +"msAuthz-CentralAccessPolicyID","62f29b60-be74-4630-9456-2f6691993a86","AD Attribute" +"msAuthz-MemberRulesInCentralAccessPolicy","57f22f7a-377e-42c3-9872-cec6f21d2e3e","AD Attribute" +"msAuthz-MemberRulesInCentralAccessPolicyBL","516e67cf-fedd-4494-bb3a-bc506a948891","AD Attribute" +"msDS-ClaimSource","fa32f2a6-f28b-47d0-bf91-663e8f910a72","AD Attribute" +"msDS-ClaimSourceType","92f19c05-8dfa-4222-bbd1-2c4f01487754","AD Attribute" +"msDS-ClaimIsValueSpaceRestricted","0c2ce4c7-f1c3-4482-8578-c60d4bb74422","AD Attribute" +"msDS-ClaimIsSingleValued","cd789fb9-96b4-4648-8219-ca378161af38","AD Attribute" +"msDS-GenerationId","1e5d393d-8cb7-4b4f-840a-973b36cc09c3","AD Attribute" +"msDS-PrimaryComputer","a13df4e2-dbb0-4ceb-828b-8b2e143e9e81","AD Attribute" +"msDS-IsPrimaryComputerFor","998c06ac-3f87-444e-a5df-11b03dc8a50c","AD Attribute" +"msKds-KDFAlgorithmID","db2c48b2-d14d-ec4e-9f58-ad579d8b440e","AD Attribute" +"msKds-KDFParam","8a800772-f4b8-154f-b41c-2e4271eff7a7","AD Attribute" +"msKds-SecretAgreementAlgorithmID","1702975d-225e-cb4a-b15d-0daea8b5e990","AD Attribute" +"msKds-SecretAgreementParam","30b099d9-edfe-7549-b807-eba444da79e9","AD Attribute" +"msKds-PublicKeyLength","e338f470-39cd-4549-ab5b-f69f9e583fe0","AD Attribute" +"msKds-PrivateKeyLength","615f42a1-37e7-1148-a0dd-3007e09cfc81","AD Attribute" +"msKds-RootKeyData","26627c27-08a2-0a40-a1b1-8dce85b42993","AD Attribute" +"msKds-Version","d5f07340-e6b0-1e4a-97be-0d3318bd9db1","AD Attribute" +"msKds-DomainID","96400482-cf07-e94c-90e8-f2efc4f0495e","AD Attribute" +"msKds-UseStartTime","6cdc047f-f522-b74a-9a9c-d95ac8cdfda2","AD Attribute" +"msKds-CreateTime","ae18119f-6390-0045-b32d-97dbc701aef7","AD Attribute" +"msImaging-ThumbprintHash","9cdfdbc5-0304-4569-95f6-c4f663fe5ae6","AD Attribute" +"msImaging-HashAlgorithm","8ae70db5-6406-4196-92fe-f3bb557520a7","AD Attribute" +"msDS-AllowedToActOnBehalfOfOtherIdentity","3f78c3e5-f79a-46bd-a0b8-9d18116ddc79","AD Attribute" +"msDS-ManagedPassword","e362ed86-b728-0842-b27d-2dea7a9df218","AD Attribute" +"msDS-ManagedPasswordId","0e78295a-c6d3-0a40-b491-d62251ffa0a6","AD Attribute" +"msDS-ManagedPasswordPreviousId","d0d62131-2d4a-d04f-99d9-1c63646229a4","AD Attribute" +"msDS-ManagedPasswordInterval","f8758ef7-ac76-8843-a2ee-a26b4dcaf409","AD Attribute" +"msDS-GroupMSAMembership","888eedd6-ce04-df40-b462-b8a50e41ba38","AD Attribute" +"msDS-GeoCoordinatesAltitude","a11703b7-5641-4d9c-863e-5fb3325e74e0","AD Attribute" +"msDS-GeoCoordinatesLatitude","dc66d44e-3d43-40f5-85c5-3c12e169927e","AD Attribute" +"msDS-GeoCoordinatesLongitude","94c42110-bae4-4cea-8577-af813af5da25","AD Attribute" +"msDS-TransformationRules","55872b71-c4b2-3b48-ae51-4095f91ec600","AD Attribute" +"msDS-IngressClaimsTransformationPolicy","86284c08-0c6e-1540-8b15-75147d23d20d","AD Attribute" +"msDS-EgressClaimsTransformationPolicy","c137427e-9a73-b040-9190-1b095bb43288","AD Attribute" +"msDS-TDOEgressBL","d5006229-9913-2242-8b17-83761d1e0e5b","AD Attribute" +"msDS-TDOIngressBL","5a5661a1-97c6-544b-8056-e430fe7bc554","AD Attribute" +"msDS-TransformationRulesCompiled","0bb49a10-536b-bc4d-a273-0bab0dd4bd10","AD Attribute" +"msDS-AppliesToResourceTypes","693f2006-5764-3d4a-8439-58f04aab4b59","AD Attribute" +"msDS-RIDPoolAllocationEnabled","24977c8c-c1b7-3340-b4f6-2b375eb711d7","AD Attribute" +"msDS-cloudExtensionAttribute1","9709eaaf-49da-4db2-908a-0446e5eab844","AD Attribute" +"msDS-cloudExtensionAttribute2","f34ee0ac-c0c1-4ba9-82c9-1a90752f16a5","AD Attribute" +"msDS-cloudExtensionAttribute3","82f6c81a-fada-4a0d-b0f7-706d46838eb5","AD Attribute" +"msDS-cloudExtensionAttribute4","9cbf3437-4e6e-485b-b291-22b02554273f","AD Attribute" +"msDS-cloudExtensionAttribute5","2915e85b-e347-4852-aabb-22e5a651c864","AD Attribute" +"msDS-cloudExtensionAttribute6","60452679-28e1-4bec-ace3-712833361456","AD Attribute" +"msDS-cloudExtensionAttribute7","4a7c1319-e34e-40c2-9d00-60ff7890f207","AD Attribute" +"msDS-cloudExtensionAttribute8","3cd1c514-8449-44ca-81c0-021781800d2a","AD Attribute" +"msDS-cloudExtensionAttribute9","0a63e12c-3040-4441-ae26-cd95af0d247e","AD Attribute" +"msDS-cloudExtensionAttribute10","670afcb3-13bd-47fc-90b3-0a527ed81ab7","AD Attribute" +"msDS-cloudExtensionAttribute11","9e9ebbc8-7da5-42a6-8925-244e12a56e24","AD Attribute" +"msDS-cloudExtensionAttribute12","3c01c43d-e10b-4fca-92b2-4cf615d5b09a","AD Attribute" +"msDS-cloudExtensionAttribute13","28be464b-ab90-4b79-a6b0-df437431d036","AD Attribute" +"msDS-cloudExtensionAttribute14","cebcb6ba-6e80-4927-8560-98feca086a9f","AD Attribute" +"msDS-cloudExtensionAttribute15","aae4d537-8af0-4daa-9cc6-62eadb84ff03","AD Attribute" +"msDS-cloudExtensionAttribute16","9581215b-5196-4053-a11e-6ffcafc62c4d","AD Attribute" +"msDS-cloudExtensionAttribute17","3d3c6dda-6be8-4229-967e-2ff5bb93b4ce","AD Attribute" +"msDS-cloudExtensionAttribute18","88e73b34-0aa6-4469-9842-6eb01b32a5b5","AD Attribute" +"msDS-cloudExtensionAttribute19","0975fe99-9607-468a-8e18-c800d3387395","AD Attribute" +"msDS-cloudExtensionAttribute20","f5446328-8b6e-498d-95a8-211748d5acdc","AD Attribute" +"msDS-IssuerCertificates","6b3d6fda-0893-43c4-89fb-1fb52a6616a9","AD Attribute" +"msDS-RegistrationQuota","ca3286c2-1f64-4079-96bc-e62b610e730f","AD Attribute" +"msDS-MaximumRegistrationInactivityPeriod","0a5caa39-05e6-49ca-b808-025b936610e7","AD Attribute" +"msDS-DeviceLocation","e3fb56c8-5de8-45f5-b1b1-d2b6cd31e762","AD Attribute" +"msDS-RegisteredOwner","617626e9-01eb-42cf-991f-ce617982237e","AD Attribute" +"msDS-RegisteredUsers","0449160c-5a8e-4fc8-b052-01c0f6e48f02","AD Attribute" +"msDS-ApproximateLastLogonTimeStamp","a34f983b-84c6-4f0c-9050-a3a14a1d35a4","AD Attribute" +"msDS-IsEnabled","22a95c0e-1f83-4c82-94ce-bea688cfc871","AD Attribute" +"msDS-DeviceOSType","100e454d-f3bb-4dcb-845f-8d5edc471c59","AD Attribute" +"msDS-DeviceOSVersion","70fb8c63-5fab-4504-ab9d-14b329a8a7f8","AD Attribute" +"msDS-DevicePhysicalIDs","90615414-a2a0-4447-a993-53409599b74e","AD Attribute" +"msDS-DeviceID","c30181c7-6342-41fb-b279-f7c566cbe0a7","AD Attribute" +"msDS-DeviceObjectVersion","ef65695a-f179-4e6a-93de-b01e06681cfb","AD Attribute" +"msds-memberOfTransitive","862166b6-c941-4727-9565-48bfff2941de","AD Attribute" +"msds-memberTransitive","e215395b-9104-44d9-b894-399ec9e21dfc","AD Attribute" +"msDS-parentdistname","b918fe7d-971a-f404-9e21-9261abec970b","AD Attribute" +"msDS-ReplValueMetaDataExt","1e02d2ef-44ad-46b2-a67d-9fd18d780bca","AD Attribute" +"msDS-DrsFarmID","6055f766-202e-49cd-a8be-e52bb159edfb","AD Attribute" +"msDS-IssuerPublicCertificates","b5f1edfe-b4d2-4076-ab0f-6148342b0bf6","AD Attribute" +"msDS-IsManaged","60686ace-6c27-43de-a4e5-f00c2f8d3309","AD Attribute" +"msDS-CloudIsManaged","5315ba8e-958f-4b52-bd38-1349a304dd63","AD Attribute" +"msDS-CloudAnchor","78565e80-03d4-4fe3-afac-8c3bca2f3653","AD Attribute" +"msDS-CloudIssuerPublicCertificates","a1e8b54f-4bd6-4fd2-98e2-bcee92a55497","AD Attribute" +"msDS-CloudIsEnabled","89848328-7c4e-4f6f-a013-28ce3ad282dc","AD Attribute" +"msDS-SyncServerUrl","b7acc3d2-2a74-4fa4-ac25-e63fe8b61218","AD Attribute" +"msDS-UserAllowedToAuthenticateTo","de0caa7f-724e-4286-b179-192671efc664","AD Attribute" +"msDS-UserAllowedToAuthenticateFrom","2c4c9600-b0e1-447d-8dda-74902257bdb5","AD Attribute" +"msDS-UserTGTLifetime","8521c983-f599-420f-b9ab-b1222bdf95c1","AD Attribute" +"msDS-ComputerAllowedToAuthenticateTo","105babe9-077e-4793-b974-ef0410b62573","AD Attribute" +"msDS-ComputerTGTLifetime","2e937524-dfb9-4cac-a436-a5b7da64fd66","AD Attribute" +"msDS-ServiceAllowedToAuthenticateTo","f2973131-9b4d-4820-b4de-0474ef3b849f","AD Attribute" +"msDS-ServiceAllowedToAuthenticateFrom","97da709a-3716-4966-b1d1-838ba53c3d89","AD Attribute" +"msDS-ServiceTGTLifetime","5dfe3c20-ca29-407d-9bab-8421e55eb75c","AD Attribute" +"msDS-AssignedAuthNPolicySilo","b23fc141-0df5-4aea-b33d-6cf493077b3f","AD Attribute" +"msDS-AssignedAuthNPolicySiloBL","33140514-f57a-47d2-8ec4-04c4666600c7","AD Attribute" +"msDS-AuthNPolicySiloMembers","164d1e05-48a6-4886-a8e9-77a2006e3c77","AD Attribute" +"msDS-AuthNPolicySiloMembersBL","11fccbc7-fbe4-4951-b4b7-addf6f9efd44","AD Attribute" +"msDS-UserAuthNPolicy","cd26b9f3-d415-442a-8f78-7c61523ee95b","AD Attribute" +"msDS-UserAuthNPolicyBL","2f17faa9-5d47-4b1f-977e-aa52fabe65c8","AD Attribute" +"msDS-ComputerAuthNPolicy","afb863c9-bea3-440f-a9f3-6153cc668929","AD Attribute" +"msDS-ComputerAuthNPolicyBL","2bef6232-30a1-457e-8604-7af6dbf131b8","AD Attribute" +"msDS-ServiceAuthNPolicy","2a6a6d95-28ce-49ee-bb24-6d1fc01e3111","AD Attribute" +"msDS-ServiceAuthNPolicyBL","2c1128ec-5aa2-42a3-b32d-f0979ca9fcd2","AD Attribute" +"msDS-AssignedAuthNPolicy","b87a0ad8-54f7-49c1-84a0-e64d12853588","AD Attribute" +"msDS-AssignedAuthNPolicyBL","2d131b3c-d39f-4aee-815e-8db4bc1ce7ac","AD Attribute" +"msDS-AuthNPolicyEnforced","7a560cc2-ec45-44ba-b2d7-21236ad59fd5","AD Attribute" +"msDS-AuthNPolicySiloEnforced","f2f51102-6be0-493d-8726-1546cdbc8771","AD Attribute" +"msDS-DeviceMDMStatus","f60a8f96-57c4-422c-a3ad-9e2fa09ce6f7","AD Attribute" +"msDS-ExternalDirectoryObjectId","bd29bf90-66ad-40e1-887b-10df070419a6","AD Attribute" +"msDS-IsCompliant","59527d0f-b7c0-4ce2-a1dd-71cef6963292","AD Attribute" +"msDS-KeyId","c294f84b-2fad-4b71-be4c-9fc5701f60ba","AD Attribute" +"msDS-KeyMaterial","a12e0e9f-dedb-4f31-8f21-1311b958182f","AD Attribute" +"msDS-KeyUsage","de71b44c-29ba-4597-9eca-c3348ace1917","AD Attribute" +"msDS-KeyPrincipal","bd61253b-9401-4139-a693-356fc400f3ea","AD Attribute" +"msDS-KeyPrincipalBL","d1328fbc-8574-4150-881d-0b1088827878","AD Attribute" +"msDS-DeviceDN","642c1129-3899-4721-8e21-4839e3988ce5","AD Attribute" +"msDS-ComputerSID","dffbd720-0872-402e-9940-fcd78db049ba","AD Attribute" +"msDS-CustomKeyInformation","b6e5e988-e5e4-4c86-a2ae-0dacb970a0e1","AD Attribute" +"msDS-KeyApproximateLastLogonTimeStamp","649ac98d-9b9a-4d41-af6b-f616f2a62e4a","AD Attribute" +"msDS-DeviceTrustType","c4a46807-6adc-4bbb-97de-6bed181a1bfe","AD Attribute" +"msDS-ShadowPrincipalSid","1dcc0722-aab0-4fef-956f-276fe19de107","AD Attribute" +"msDS-KeyCredentialLink","5b47d60f-6090-40b2-9f37-2a4de88f3063","AD Attribute" +"msDS-KeyCredentialLink-BL","938ad788-225f-4eee-93b9-ad24a159e1db","AD Attribute" +"msDS-ExpirePasswordsOnSmartCardOnlyAccounts","3417ab48-df24-4fb1-80b0-0fcb367e25e3","AD Attribute" +"msDS-UserAllowedNTLMNetworkAuthentication","7ece040f-9327-4cdc-aad3-037adfe62639","AD Attribute" +"msDS-ServiceAllowedNTLMNetworkAuthentication","278947b9-5222-435e-96b7-1503858c2b48","AD Attribute" +"msDS-StrongNTLMPolicy","aacd2170-482a-44c6-b66e-42c2f66a285c","AD Attribute" +"msDS-SourceAnchor","b002f407-1340-41eb-bca0-bd7d938e25a9","AD Attribute" +"msDS-ObjectSoa","34f6bdf5-2e79-4c3b-8e14-3d93b75aab89","AD Attribute" +addressBookRoots2,"508ca374-a511-4e4e-9f4f-856f61a6b7e4","AD Attribute" +globalAddressList2,"4898f63d-4112-477c-8826-3ca00bd8277d","AD Attribute" +templateRoots2,"b1cba91a-0682-4362-a659-153e201ef069","AD Attribute" +"ms-Mcs-AdmPwdExpirationTime","b6b11ea3-6db4-4bae-8a4b-94a54250c869","AD Attribute" +"ms-Mcs-AdmPwd","71f6c31d-531d-4c45-828e-db6cdab302c8","AD Attribute" +Applications,"{F9C77450-3A41-477E-9310-9ACD617BD9E3}","CSE GUID" +"Data Sources","{728EE579-943C-4519-9EF7-AB56765798ED}","CSE GUID" +Devices,"{1A6364EB-776B-4120-ADE1-B63A406A76B5}","CSE GUID" +Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID" +"Environment Variables","{0E28E245-9368-4853-AD84-6DA3BA35BB75}","CSE GUID" +Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID" +"Folder Options","{A3F3E39B-5D83-4940-B954-28315B82F0A8}","CSE GUID" +Folders,"{6232C319-91AC-4931-9385-E70C2B099F0E}","CSE GUID" +"Ini Files","{74EE6C03-5363-4554-B161-627540339CAB}","CSE GUID" +"Internet Settings","{E47248BA-94CC-49C4-BBB5-9EB7F05183D0}","CSE GUID" +"Local users and groups","{17D89FEC-5C44-4972-B12D-241CAEF74509}","CSE GUID" +"Network Options","{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}","CSE GUID" +"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID" +"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID" +Printers,"{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}","CSE GUID" +"Regional Options","{E5094040-C46C-4115-B030-04FB2E545B00}","CSE GUID" +Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID" +ScheduledTasks,"{AADCED64-746C-4633-A97C-D61349046527}","CSE GUID" +Services,"{91FBB303-0CD5-4055-BF42-E512A681B325}","CSE GUID" +Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID" +"Start Menu","{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}","CSE GUID" +Scripts,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID" +Registry,"{35378EAC-683F-11D2-A89A-00C04FBBCFA2}","CSE GUID" +Applications,"{0DA274B5-EB93-47A7-AAFB-65BA532D3FE6}","Tool extension GUID" +"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","Tool extension GUID" +Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","Tool extension GUID" +Drives,"{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}","Tool extension GUID" +"Environment Variables","{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}","Tool extension GUID" +Files,"{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}","Tool extension GUID" +"Folder Options","{3BFAE46A-7F3A-467B-8CEA-6AA34DC71F53}","Tool extension GUID" +Folders,"{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}","Tool extension GUID" +"Ini Files","{516FC620-5D34-4B08-8165-6A06B623EDEB}","Tool extension GUID" +"Internet Settings","{5C935941-A954-4F7C-B507-885941ECE5C4}","Tool extension GUID" +"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","Tool extension GUID" +"Network Options","{949FB894-E883-42C6-88C1-29169720E8CA}","Tool extension GUID" +"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","Tool extension GUID" +"Power Options","{9AD2BAFE-63B4-4883-A08C-C3C6196BCAFD}","Tool extension GUID" +Printers,"{A8C42CEA-CDB8-4388-97F4-5831F933DA84}","Tool extension GUID" +"Regional Options","{B9CCA4DE-E2B9-4CBD-BF7D-11B6EBFBDDF7}","Tool extension GUID" +Registry,"{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}","Tool extension GUID" +ScheduledTasks,"{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}","Tool extension GUID" +Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","Tool extension GUID" +Shortcuts,"{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}","Tool extension GUID" +"Start Menu","{CF848D48-888D-4F45-B530-6A201E62A605}","Tool extension GUID" +Scripts,"{40B6664F-4972-11D1-A7CA-0000F87571E3}","Tool extension GUID" +Registry,"{D02B1F72-3407-48AE-BA88-E8213C6761F1}","Tool extension GUID" +"Computer Policy Settings","{0F6B957D-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID" +"User Policy Settings - Restrict Run","{0F6B957E-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID" +"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","CSE GUID / Tool extension GUID" +Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","CSE GUID / Tool extension GUID" +"Folder Redirection","{25537BA6-77A8-11D2-9B6C-0000F8080861}","CSE GUID / Tool extension GUID" +"Remote Installation Services","{3060E8CE-7020-11D2-842D-00C04FA372D4}","CSE GUID / Tool extension GUID" +"Registry Settings","{35378EAC-683F-11D2-A89A-00C04FBBCFA2","CSE GUID / Tool extension GUID" +"Microsoft Disk Quota","{3610EDA5-77EF-11D2-8DC5-00C04FA31A66}","CSE GUID / Tool extension GUID" +"Scripts (Logon/Logoff) Run Restriction","{40B66650-4972-11D1-A7CA-0000F87571E3}","CSE GUID / Tool extension GUID" +ProcessScriptsGroupPolicy,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID / Tool extension GUID" +"Print Policy in PolicyMaker","{47BA4403-1AA0-47F6-BDC5-298F96D1C2E3}","CSE GUID / Tool extension GUID" +"Internet Explorer Zonemapping","{4CFB60C1-FAA6-47F1-89AA-0B18730C9FD3}","CSE GUID / Tool extension GUID" +"Certificates Run Restriction","{53D6AB1D-2488-11D1-A28C-00C04FB94F17}","CSE GUID / Tool extension GUID" +Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID / Tool extension GUID" +"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID / Tool extension GUID" +Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID / Tool extension GUID" +"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","CSE GUID / Tool extension GUID" +"Internet Explorer User Accelerators/PolicyMaker","{7B849A69-220F-451E-B3FE-2CB811AF94AE}","CSE GUID / Tool extension GUID" +"Computer Restricted Groups","{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}","CSE GUID / Tool extension GUID" +Security,"{827D319E-6EAC-11D2-A4EA-00C04F79F83A}","CSE GUID / Tool extension GUID" +"Folder Redirection","{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Deployed Printer Connections","{8A28E2C5-8D06-49A4-A08C-632DAA493E17}","CSE GUID / Tool extension GUID" +"Software Installation (Computers).","{942A8E4F-A261-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Internet Explorer Maintenance policy processing","{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B]","CSE GUID / Tool extension GUID" +Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID / Tool extension GUID" +"EFS Recovery","{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A]","CSE GUID / Tool extension GUID" +"802.3 Group Policy","{B587E2B1-4D59-4E7E-AED9-22B9DF11D053}","CSE GUID / Tool extension GUID" +"Software Installation (Users) Run Restriction","{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","CSE GUID / Tool extension GUID" +Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID / Tool extension GUID" +"Microsoft Offline Files","{C631DF4C-088F-4156-B058-4375F0853CD8}","CSE GUID / Tool extension GUID" +"Application Management","{C6DC5466-785A-11D2-84D0-00C04FB169F7]","CSE GUID / Tool extension GUID" +Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","CSE GUID / Tool extension GUID" +"User Policy Settings","{D02B1F73-3407-48AE-BA88-E8213C6761F1}","CSE GUID / Tool extension GUID" +"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID / Tool extension GUID" +"Policy Maker","{F0DB2806-FD46-45B7-81BD-AA3744B32765}","CSE GUID / Tool extension GUID" +"Policy Maker","{F17E8B5B-78F2-49A6-8933-7B767EDA5B41}","CSE GUID / Tool extension GUID" +"Policy Maker","{F27A6DA8-D22B-4179-A042-3D715F9E75B5}","CSE GUID / Tool extension GUID" +"Policy Maker","{F581DAE7-8064-444A-AEB3-1875662A61CE}","CSE GUID / Tool extension GUID" +"Policy Maker","{F648C781-42C9-4ED4-BB24-AEB8853701D0}","CSE GUID / Tool extension GUID" +"Policy Maker","{F6E72D5A-6ED3-43D9-9710-4440455F6934}","CSE GUID / Tool extension GUID" +"Enterprise QoS","{FB2CA36D-0B40-4307-821B-A13B252DE56C}","CSE GUID / Tool extension GUID" +"Internet Explorer Maintenance Extension protocol","{FC715823-C5FB-11D1-9EEF-00A0C90347FF}","CSE GUID / Tool extension GUID" +"Policy Maker","{FD2D917B-6519-4BF7-8403-456C0C64312F}","CSE GUID / Tool extension GUID" +"Policy Maker","{FFC64763-70D2-45BC-8DEE-7ACAF1BA7F89}","CSE GUID / Tool extension GUID" +TCPIP,"{CDEAFC3D-948D-49DD-AB12-E578BA4AF7AA}","CSE GUID / Tool extension GUID" +"IP Security","{E437BC1C-AA7D-11D2-A382-00C04F991E27]","CSE GUID / Tool extension GUID" +"Audit Policy Configuration","{F3CCC681-B74C-4060-9F26-CD84525DCA2A}","CSE GUID / Tool extension GUID" +"Windows Firewall","{B05566AC-FE9C-4368-BE01-7A4CBB6CBA11}","CSE GUID / Tool extension GUID" +"Software Installation","{C6DC5466-785A-11D2-84D0-00C04FB169F7}","CSE GUID / Tool extension GUID" \ No newline at end of file diff --git a/lookups/msad_guid_lookup.yml b/lookups/msad_guid_lookup.yml new file mode 100644 index 0000000000..b036f88e84 --- /dev/null +++ b/lookups/msad_guid_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace control access rights guids +filename: msad_guid_lookup.csv +name: msad_guid_lookup \ No newline at end of file