Getting Data In

Is there a parser that will convert Windows SDDL or ACE format strings into human readable content?

javiergn
Super Champion

Hi,

Is anyone aware of an existing parser that will convert windows SDDL format or ACE format strings into human readable content?

as an exanples piece of SDDL
D:AI(A;OICIID;FA;;;BU)(A;ID;FA;;;BA)

Thanks

Tags (1)
0 Karma

nadeemka2000
New Member

Hi,

Download sddlparse tool from http://blogs.microsoft.co.il/files/folders/guyt/entry70399.aspx

Create .vbs file with below code:

strSDDLParse = "C:\Tools\SDDLParse.exe"
strSDDL = "D:PAI(A;OICI;0x1201bf;;;S-1-5-21-1216582894-834684500-1334827815-316441)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;S-1-5-21-1216582894-834684500-1334827815-458061)"
Set objShell = CreateObject("WScript.Shell")
Set objExec = objShell.Exec(strSDDLParse & " " & strSDDL)
While objExec.Status = 0
WScript.Sleep 100
Wend
WScript.Echo objExec.StdOut.ReadAll

Edit the code accordingly and specify the SDDL string to convert

Thanks,

Nadeem

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...