NtObjectManager.XML
|
<?xml version="1.0"?>
<doc> <assembly> <name>NtObjectManager</name> </assembly> <members> <member name="T:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult"> <summary> <para type="description">General Access check result.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.Name"> <summary> The name of the object which was accessed (depends on the type). </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.TypeName"> <summary> Name of the type accessed. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.GrantedAccess"> <summary> Granted access. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.GrantedAccessString"> <summary> Get granted access as a type specific string </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.GrantedGenericAccessString"> <summary> Get granted access as generic access string. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.GenericMapping"> <summary> The generic mapping associated with this type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.SecurityDescriptor"> <summary> The security descriptor associated with this access check. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.SecurityDescriptorBase64"> <summary> The security descriptor associated with this access check in base64 format. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.Owner"> <summary> The SID owner of the resource from the security descriptor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.TokenInfo"> <summary> Information the token used in the access check. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.IsRead"> <summary> Was read access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.IsWrite"> <summary> Was write access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.IsExecute"> <summary> Was execute access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.IsAll"> <summary> Was all access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.IsDirectory"> <summary> Is the resource being access a directory. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.TokenId"> <summary> Unique key for access check result (based on TokenId) </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.HasMandatoryLabel"> <summary> Indicates if the security descriptor has an integrity label. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessCheckResult.HasProcessTrustLabel"> <summary> Indicates if the security descriptor has a process trust label. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseWithAccessCmdlet`1"> <summary> Base class for accessible checks with an access parameter. </summary> <typeparam name="A">The type of access rights to check against.</typeparam> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseWithAccessCmdlet`1.Access"> <summary> <para type="description">Access rights to check for in an object's access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseWithAccessCmdlet`1.AllowPartialAccess"> <summary> <para type="description">If AccessRights specified require that only part of the access rights are required to match an access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseWithAccessCmdlet`1.AllowEmptyAccess"> <summary> <para type="description">If set an access entry will be generated even if granted access is 0.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.DeviceAccessCheckResult"> <summary> <para type="description">Access check result for a device.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DeviceAccessCheckResult.NamespacePath"> <summary> Indicates this was a namespace open </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DeviceAccessCheckResult.DeviceType"> <summary> Indicates the type of device. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DeviceAccessCheckResult.Characteristics"> <summary> Indicates the device characteristics. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult"> <summary> <para type="description">Access check result for a directory service object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.DistinguishedName"> <summary> The name of the object which was accessed. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Name"> <summary> The name of the object. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Domain"> <summary> The domain of the object. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.GrantedAccess"> <summary> Granted access for the SD with the base object type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.GrantedAccessNoType"> <summary> Granted access for the SD without any object type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.MaximumGrantedAccess"> <summary> The maximum granted access for any components of the object. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Modifiable"> <summary> Is the entry modifiable by the user in any way? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Controllable"> <summary> Is the entry controllable by one or more control access rights? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.SchemaClass"> <summary> The schema class for the object. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.DynamicAuxiliaryClasses"> <summary> List of dynamic auxiliary classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.ObjectClass"> <summary> The name of the schema class. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.ExtendedRights"> <summary> Access check results for extended rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Classes"> <summary> Access check results for schema classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.CreateableClasses"> <summary> Get the list of creatable classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.AnyCreateableClasses"> <summary> Check if there are any createable classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.DeletableClasses"> <summary> Get the list of deletable classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.AnyDeletableClasses"> <summary> Check if there are any deletable classes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Attributes"> <summary> Access check results for schema attributes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.ReadableAttributes"> <summary> Get the list of readable attributes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.WritableAttributes"> <summary> Get the list of writable attributes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.AnyWritableAttributes"> <summary> Check if there are any writable attributes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.PropertySets"> <summary> Property set extended rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.ReadablePropertySets"> <summary> Get the list of readable property sets. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.WritablePropertySets"> <summary> Get the list of writable attributes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Control"> <summary> Control access rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.GrantedControl"> <summary> Get the list of control access rights granted. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.AnyGrantedControl"> <summary> Check if there are any granted control access rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.WriteValidated"> <summary> Write validated access rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.GrantedWriteValidated"> <summary> Get the list of write validated access rights granted. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.AnyGrantedWriteValidated"> <summary> Check if there are any granted write validated access rights. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.SecurityDescriptor"> <summary> The security descriptor associated with this access check. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Owner"> <summary> The SID owner of the resource from the security descriptor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.TokenInfo"> <summary> Information the token used in the access check. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.UserName"> <summary> The username for the token. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.IsRead"> <summary> Was read access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.IsWrite"> <summary> Was write access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.IsExecute"> <summary> Was execute access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.IsAll"> <summary> Was all access granted? </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectAccessCheckResult.Deleted"> <summary> Is the object deleted? </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.DsObjectTypeAccessCheckResult`1"> <summary> Access check result for an object type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectTypeAccessCheckResult`1.Object"> <summary> The object for the access check. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.DsObjectTypeAccessCheckResult`1.GrantedAccess"> <summary> The granted access. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.DsObjectTypeAccessCheckResult`1.IsAccessGranted(NtApiDotNet.Win32.DirectoryService.DirectoryServiceAccessRights)"> <summary> Indicates if a specific access has been granted. </summary> <param name="access">The access to check.</param> <returns>True if access granted.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.DsObjectTypeAccessCheckResult`1.ToString"> <summary> Overridden ToString method. </summary> <returns>The name of the object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.EventTraceAccessCheckResult"> <summary> <para type="description">Access check result for an event trace.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.EventTraceAccessCheckResult.Id"> <summary> The ID of the event trace provider. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.EventTraceAccessCheckResult.Source"> <summary> The source of the event trace provider. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.EventTraceAccessCheckResult.Provider"> <summary> The event trace provider. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.FwObjectAccessCheckResult"> <summary> <para type="description">Access check result for a firewall object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.FwObjectAccessCheckResult.Description"> <summary> Firewall object description. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.FwObjectAccessCheckResult.Key"> <summary> Firewall object key. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.FwObjectAccessCheckResult.KeyName"> <summary> Firewall object key name. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.FwObjectType"> <summary> <para type="description">Type of firewall object to check.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.DsObjectNamingContext"> <summary> <para type="description">Flags for the specifying default context for a domain.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DsObjectNamingContext.Default"> <summary> Default naming context. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DsObjectNamingContext.Configuration"> <summary> Configuration naming context. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DsObjectNamingContext.Schema"> <summary> Schema naming context. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject"> <summary> <para type="synopsis">Get a list of directory service objects that can be opened by a user.</para> <para type="description">This cmdlet checks one or more directory service objects tries to determine the access a user has to that object. If no users are specified the current user is used.</para> </summary> <example> <code>Get-AccessibleDsObject -NamingContext Default -Recurse</code> <para>Check accessible DS objects under the current default naming context for the current domain.</para> </example> <example> <code>Get-AccessibleDsObject -NamingContext Default -Recurse -Domain SALES</code> <para>Check accessible DS objects under the current default naming context for the SALES domain.</para> </example> <example> <code>Get-AccessibleDsObject -DistinguishedName "CN=Users,DC=domain,DC=local" -Recurse</code> <para>Check accessible DS objects under the Users container.</para> </example> <example> <code>Get-AccessibleDsObject -NamingContext Default -Recurse -ObjectType user</code> <para>Check accessible user DS objects under the current default naming context for the current domain.</para> </example> <example> <code>Get-AccessibleDsObject -NamingContext Default -Recurse -UserName "DOMAIN\user"</code> <para>Check accessible user DS objects under the current default naming context for the current domain for the DOMAIN\user user..</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.UserSid"> <summary> <para type="description">Specify a list of SIDs for the access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.UserName"> <summary> <para type="description">Specify a list of user names for the access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Context"> <summary> <para type="description">Specify a list of pre-configured AuthZ context for the access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.UseLocalGroup"> <summary> <para type="description">Specify to avoid looking up groups for a domain user and just use what's on the local system. This might give inaccurate results. You should also use this if testing on the DC.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Server"> <summary> <para type="description">Specify a server for use for remote access checking.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Domain"> <summary> <para type="description">Specify the target domain or domain controller for enumeration.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.DistinguishedName"> <summary> <para type="description">Distinguished names of objects to check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.NamingContext"> <summary> <para type="description">Naming context of objects to check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.All"> <summary> <para type="description">Check all naming context including DNS roots..</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Recurse"> <summary> <para type="description">Specify the recursively enumerate objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.RecurseSubtree"> <summary> <para type="description">Specify to use a recursive subtree search for objects. This is useful when the root object doesn't allow access, but can be slow if there's a lot of objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Depth"> <summary> <para type="description">When recursing specify maximum depth.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Filter"> <summary> <para type="description">Specify a common name filter when enumerating objects. This removes paths which don't match and doesn't inspect them further. Takes the form of a LDAP style Glob such as *.txt.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.ObjectClass"> <summary> <para type="description">Specify a list of object classes to include in the enumeration.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Include"> <summary> <para type="description">Include specific objects. This happens after enumeration so it just excludes them from the output. Takes the form of a DOS style Glob such as *.txt.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.Exclude"> <summary> <para type="description">Exclude specific object names. This happens after enumeration so it just excludes them from the output. Takes the form of a DOS style Glob.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.LDAPFilter"> <summary> <para type="description">Specify an arbitrary LDAP filter when enumerating objects. This overrides any other pre-enumeration filtering option.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.AllowEmptyAccess"> <summary> <para type="description">Specify to return all results even if not granted any access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.IncludeDeleted"> <summary> <para type="description">Specify to include deleted items in the analysis.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.ProcessRecord"> <summary> Overridden process record method. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleDsObject.BeginProcessing"> <summary> Begin processing. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleEventTraceCmdlet"> <summary> <para type="synopsis">Get a list of ETW providers accessible by a specified token.</para> <para type="description">This cmdlet checks all ETW providers and tries to determine if one or more specified tokens can access them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>This will only work if run as an administrator.</remarks> <example> <code>Get-AccessibleEventTrace</code> <para>Check all accessible ETW providers for the current process token.</para> </example> <example> <code>Get-AccessibleEventTrace -ProcessIds 1234,5678</code> <para>>Check all accessible ETW providers for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleEventTrace -Tokens $token</code> <para>Get all ETW providers which can be accessed by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleEventTraceCmdlet.ProviderId"> <summary> <para type="description">Specify list of ETW provider GUID to check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleEventTraceCmdlet.Name"> <summary> <para type="description">Specify list of ETW provider names to check.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet"> <summary> <para type="synopsis">Get a list of firewall objects accessible by a specified token.</para> <para type="description">This cmdlet checks all firewall objects and tries to determine if one or more specified tokens can access them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>This typically only work if run as an administrator.</remarks> <example> <code>Get-AccessibleFwObject</code> <para>Check all accessible firewall objects for the current process token.</para> </example> <example> <code>Get-AccessibleFwObject -ProcessIds 1234,5678</code> <para>>Check all accessible firewall objects for the process tokens of PIDs 1234 and 5678</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet.ServerName"> <summary> <para type="description">Specify server name running the firewall service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet.Credentials"> <summary> <para type="description">Specify user credentials for remote firewall service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet.AuthnType"> <summary> <para type="description">Specify RPC authentication type for remote firewall service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet.ObjectType"> <summary> <para type="description">Specify what objects to check.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleFwObjectCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1"> <summary> Base class for path based accessible checks. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Path"> <summary> <para type="description">Specify a list of native paths to check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Win32Path"> <summary> <para type="description">Specify a list of paths in a Win32 format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.FormatWin32Path"> <summary> <para type="description">When generating the results format path in Win32 format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Recurse"> <summary> <para type="description">Specify whether to recursively check the path for access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Depth"> <summary> <para type="description">When recursing specify maximum depth.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Filter"> <summary> <para type="description">Specify a filter when enumerating paths. This removes paths which don't match and doesn't inspect them further. Takes the form of a DOS style Glob such as *.txt.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Include"> <summary> <para type="description">Include specific path components. This happens after enumeration so it just excludes them from the output. Takes the form of a DOS style Glob such as *.txt.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.Exclude"> <summary> <para type="description">Exclude specific path components. This happens after enumeration so it just excludes them from the output. Takes the form of a DOS style Glob.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.FollowLink"> <summary> <para type="description">Specify to follow links in an recursive enumeration.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.CaseSensitive"> <summary> <para type="description">Specify the checks should be attempted case sensitively.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.ConvertWin32Path(System.String)"> <summary> Convert a Win32 path to a native path. </summary> <param name="win32_path">The Win32 path to convert.</param> <returns>The converted native path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessiblePathCmdlet`1.RunAccessCheckPath(System.Collections.Generic.IEnumerable{NtObjectManager.Cmdlets.Accessible.TokenEntry},System.String)"> <summary> Run an access check with a path. </summary> <param name="tokens">The list of tokens.</param> <param name="path">The path to check.</param> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.TaskCheckMode"> <summary> <para type="description">Limit access check to specific types of task information.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.TaskCheckMode.TasksOnly"> <summary> Check tasks only. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.TaskCheckMode.FoldersOnly"> <summary> Check folders only. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.TaskCheckMode.All"> <summary> Check both folders and tasks. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleScheduledTaskCmdlet"> <summary> <para type="synopsis">Get a list of scheduled tasks openable by a specified token.</para> <para type="description">This cmdlet checks all scheduled tasks and tries to determine if one or more specified tokens can open them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>For best results this command should be run as an administrator.</remarks> <example> <code>Get-AccessibleScheduledTask</code> <para>Check all accessible scheduled tasks for the current process token.</para> </example> <example> <code>Get-AccessibleScheduledTask -Executable</code> <para>Check all executable scheduled tasks for the current process token.</para> </example> <example> <code>Get-AccessibleScheduledTask -ProcessIds 1234,5678</code> <para>>Check all accessible scheduled tasks for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleScheduledTask -Tokens $token -AccessRights GenericWrite</code> <para>Get all scheduled tasks which can be written by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleScheduledTaskCmdlet.CheckMode"> <summary> <para type="description">Limit access check to specific types of files.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleScheduledTaskCmdlet.DirectoryAccess"> <summary> <para type="description">Specify a set of directory access rights which a folder must at least be accessible for to count as an access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleScheduledTaskCmdlet.Executable"> <summary> <para type="description">Shortcut to specify that we're querying for executable tasks.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleScheduledTaskCmdlet.Writable"> <summary> <para type="description">Shortcut to specify that we're querying for writable tasks or directories.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult"> <summary> <para type="description">Access check result for a token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.ProcessName"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.ProcessImagePath"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.ProcessId"> <summary> Process ID of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.ProcessCommandLine"> <summary> Command line of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.ProcessTokenInfo"> <summary> Gets the information for the process token, not the token used to check access. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.UserName"> <summary> Token username </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.IntegrityLevel"> <summary> Token integrity level </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.Elevated"> <summary> Elevated token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.Restricted"> <summary> Restricted token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.WriteRestricted"> <summary> Write restricted token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.AppContainer"> <summary> App container token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.Sandbox"> <summary> Is the token sandboxed. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.NoChildProcess"> <summary> Get whether the token can be used for child processes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.SessionId"> <summary> The session ID of the token. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenAccessCheckResult.AuthenticationId"> <summary> Get the authentication ID. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleTokenCmdlet"> <summary> <para type="synopsis">Get a list of tokens that can be opened by a specified token.</para> <para type="description">This cmdlet checks all processes for primary tokens tries to determine if one or more specified tokens can open them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>For best results this command should be run as an administrator with SeDebugPrivilege, ideally as SYSTEM.</remarks> <example> <code>Get-AccessibleToken</code> <para>Check all accessible tokens for the current process token.</para> </example> <example> <code>Get-AccessibleToken -ProcessIds 1234,5678</code> <para>>Check all accessible tokens for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleToken -Tokens $token -AccessRights GenericWrite</code> <para>Get all tokens with can be written by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleTokenCmdlet.ShowDeadProcesses"> <summary> <para type="description">Specify that dead process tokens should be shown.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleTokenCmdlet.CurrentSession"> <summary> <para type="description">Specify to only look for processes in the current session.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.WindowStationCheckMode"> <summary> <para type="description">Specify check mode.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.WindowStationCheckMode.WindowStationOnly"> <summary> Only check Window Stations. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.WindowStationCheckMode.DesktopOnly"> <summary> Only check Desktops. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.WindowStationCheckMode.WindowStationAndDesktop"> <summary> Check Window Stations and Desktops. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleWindowStation"> <summary> <para type="synopsis">Get a list of Window Station an/or Desktops accessible by a specified token.</para> <para type="description">This cmdlet checks all Window Stations/Desktops and tries to determine if one or more specified tokens can access them. If no tokens are specified then the current process token is used. Note, this will only check the current session.</para> </summary> <example> <code>Get-AccessibleWindowStation</code> <para>Check all accessible Window Stations for the current process token.</para> </example> <example> <code>Get-AccessibleWindowStation -CheckMode WindowStationAndDesktop</code> <para>Check all accessible Window Stations and Desktops for the current process token.</para> </example> <example> <code>Get-AccessibleWindowStation -ProcessIds 1234,5678</code> <para>>Check all accessible Window Stations for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleWindowStation -Tokens $token</code> <para>Get all Window Stations which can be accessed by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleWindowStation.CheckMode"> <summary> <para type="description">Specify check mode.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleWindowStation.DesktopAccess"> <summary> <para type="description">Specify desktop access rights when checking Desktops.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleWnfCmdlet"> <summary> <para type="synopsis">Get a list of WNF notifications accessible by a specified token.</para> <para type="description">This cmdlet checks all WNF providers and tries to determine if one or more specified tokens can access them. If no tokens are specified then the current process token is used.</para> </summary> <example> <code>Get-AccessibleWnf</code> <para>Check all accessible WNF notifications for the current process token.</para> </example> <example> <code>Get-AccessibleWnf -ProcessIds 1234,5678</code> <para>>Check all accessible WNF notifications for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleWnf -Tokens $token</code> <para>Get all WNF notifications which can be accessed by a low integrity copy of current token.</para> </example> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult"> <summary> <para type="description">Access check result for a handle.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult.MaximumAccess"> <summary> Specifies the maximum access that can be accessed if the resource was reopened. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult.DifferentAccess"> <summary> Specifies whether the access granted in the handle is different than would be granted if the resource was reopened. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult.ProcessId"> <summary> Process ID containing the handle. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult.Handle"> <summary> The handle value. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.HandleAccessCheckResult.Object"> <summary> The object address. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation"> <summary> Token information when the source was a process token. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.ProcessName"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.ProcessImagePath"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.NativeImagePath"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.ProcessId"> <summary> Process ID of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.ProcessCommandLine"> <summary> Command line of the process. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.ProcessTokenInformation.ToString"> <summary> Overridden ToString. </summary> <returns>The information as a string.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult"> <summary> <para type="description">Access check result for a scheduled task.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Enabled"> <summary> Whether the task is enabled. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Hidden"> <summary> Whether the task is hidden. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.AllowDemandStart"> <summary> Whether the task can be started on demand. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Xml"> <summary> The full XML registration for the task. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.LogonType"> <summary> The logon type of the task. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.RunLevel"> <summary> The run level of the type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Principal"> <summary> The principal of the type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Actions"> <summary> List of the actions. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.ActionCount"> <summary> Number of actions. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.DefaultActionType"> <summary> The default type of action. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.DefaultAction"> <summary> The default action to be invoked. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.TaskName"> <summary> Get the task name. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.TaskPath"> <summary> Get the task path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.RequiredPrivileges"> <summary> Required privileged for task. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.ProcessTokenSid"> <summary> Process token SID. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.HasActionArguments"> <summary> Indicates whether the task has action arguments. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.Run(System.String[])"> <summary> Try and run the last with optional arguments. </summary> <param name="args">Optional arguments.</param> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.ScheduledTaskAccessCheckResult.RunEx(NtObjectManager.Utils.ScheduledTask.TaskRunFlags,System.Int32,System.String,System.String[])"> <summary> Try and run the last with optional arguments. </summary> <param name="args">Optional arguments.</param> <param name="flags">Flags for the run operation.</param> <param name="session_id">Optional session ID (Needs UseSessionId flag).</param> <param name="user">Optional user name or SID.</param> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult"> <summary> <para type="description">Access check result for a service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.Triggers"> <summary> Service triggers for service. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.TriggerGrantedAccess"> <summary> Indicates additional access granted based on the Triggers. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.OriginalGrantedAccess"> <summary> Indicates original access granted without triggers. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.Service"> <summary> Indicates the service information. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.ImagePath"> <summary> Indicates the service image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ServiceAccessCheckResult.ServiceDll"> <summary> Indicates the service DLL. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ServiceCheckMode"> <summary> <para type="description">Check mode for accessible services.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ServiceCheckMode.ServiceOnly"> <summary> Only services. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ServiceCheckMode.DriverOnly"> <summary> Only drivers. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ServiceCheckMode.ServiceAndDriver"> <summary> Services and drivers. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.WnfAccessCheckResult"> <summary> <para type="description">Access check result for a WNF notification.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.WnfAccessCheckResult.StateName"> <summary> Get the state name for this WNF entry. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.WnfAccessCheckResult.Lifetime"> <summary> Get the associated lifetime for the state name. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.WnfAccessCheckResult.SubscribersPresent"> <summary> Get if the state has subscribers. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.TokenInformation"> <summary> Information about a token. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.User"> <summary> Token user. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.UserName"> <summary> Token user name. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.IntegrityLevel"> <summary> Token integrity level </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.TokenType"> <summary> Token type </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.ImpersonationLevel"> <summary> Token impersonation level </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.TokenId"> <summary> Token ID </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.AuthenticationId"> <summary> Get the authentication ID. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Origin"> <summary> Get the origin authentication ID. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Elevated"> <summary> Elevated token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Restricted"> <summary> Restricted token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.WriteRestricted"> <summary> Write restricted token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.AppContainer"> <summary> App container token </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.AppContainerSid"> <summary> App container SID (if an AppContainer) </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.ElevationType"> <summary> Get the elevation type. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.LowPrivilegeAppContainer"> <summary> Low privilege AC </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.SessionId"> <summary> The session ID of the token. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Groups"> <summary> Get token groups. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.RestrictedSids"> <summary> Get restricted SIDs. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Capabilities"> <summary> Get capability SIDs. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Privileges"> <summary> Get privileges. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Sandbox"> <summary> Whether the token is considered sandboxed. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.NoChildProcess"> <summary> Get whether the token can be used for child processes. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.Flags"> <summary> Get the token flags. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.UIAccess"> <summary> Get the UI access flag. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.MandatoryPolicy"> <summary> Get the token mandatory policy. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TokenInformation.SourceData"> <summary> Additonal information of where the token was sourced from </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.TokenInformation.ToString"> <summary> Overridden ToString. </summary> <returns>The information as a string.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet"> <summary> <para type="synopsis">Test whether network access is allowed based on a specific token.</para> <para type="description">This cmdlet tests network access for a particular token. This can either be network client access or network server access.</para> </summary> <example> <code>Test-NetworkAccess -HostName www.google.com -Port 80</code> <para>Test network access for the current user to www.google.com:80.</para> </example> <example> <code>Test-NetworkAccess -Listen 1234</code> <para>Test network access for the current user by listening on port 1234.</para> </example> <example> <code>Test-NetworkAccess -HostName www.google.com -Port 80 -ProcessId 1234</code> <para>Test network access for the process 1234 to www.google.com:80.</para> </example> <example> <code>Test-NetworkAccess -HostName www.google.com -Port 80 -Token $token</code> <para>Test network access for a specified token to www.google.com:80.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.Listen"> <summary> <para type="description">Specify to test listening on a port.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.HostName"> <summary> <para type="description">Specify to the host for connecting or listening.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.Port"> <summary> <para type="description">Specify to the host for connecting or listening.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.Process"> <summary> <para type="description">Specify a process to get the token from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to get the token from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.Token"> <summary> <para type="description">Specify the token to use for the test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.IPv6"> <summary> <para type="description">Specify to use IPv6 instead of IPv4.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.TestNetworkAccessCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet"> <summary> Common base cmdlet for commands which look at accessible resources. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.ProcessId"> <summary> <para type="description">Specify a list of process IDs to open for their tokens.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.ProcessName"> <summary> <para type="description">Specify a list of process names to open for their tokens.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.ProcessCommandLine"> <summary> <para type="description">Specify a list of command lines to filter on find for the process tokens.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.Token"> <summary> <para type="description">Specify a list token objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.Process"> <summary> <para type="description">Specify a list of process objects to get tokens from.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.CommonAccessBaseCmdlet.ProcessRecord"> <summary> Overridden process record method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.DeviceCheckMode"> <summary> <para type="description">Mode for checking device object.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DeviceCheckMode.DeviceOnly"> <summary> Only check root device. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DeviceCheckMode.NamespaceOnly"> <summary> Only check device namespace. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.DeviceCheckMode.DeviceAndNamespace"> <summary> Check device and namespace. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet"> <summary> <para type="synopsis">Get a list of devices that can be opened by a specified token.</para> <para type="description">This cmdlet checks a device and optionally tries to determine if one or more specified tokens can open it. If no tokens are specified the current process token is used.</para> </summary> <example> <code>Get-AccessibleDevice \Device</code> <para>Check accessible devices under \Device for the current process token.</para> </example> <example> <code>Get-AccessibleDevice \Device -AccessRights GenericWrite</code> <para>Check write accessible devices under \Device for the current process token.</para> </example> <example> <code>Get-AccessibleDevice \Device -ProcessIds 1234,5678</code> <para>Check accessible devices under \Device for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>Get-AccessibleDevice \Device -CheckMode DeviceAndNamespace</code> <para>Check accessible devices under \Device for the current process token including ones under a namespace.</para> </example> <example> <code>Get-AccessibleDevice \ -Recurse</code> <para>Check recursively for accessible devices under \ for the current process token.</para> </example> <example> <code>Get-AccessibleDevice \ -Recurse -MaxDepth 5</code> <para>Check recursively for accessible objects under \BaseNamedObjects for the current process token to a maximum depth of 5.</para> </example> <example> <code>Get-AccessibleDevice \Device\Afd,\Device\Blah</code> <para>Check two devices for the current process token.</para> </example> <example> <code>Get-AccessibleDevice \ -Recurse -AccessRights GenericWrite</code> <para>Check recursively for accessible devices under with write access.</para> </example> <example> <code>Get-AccessibleDevice \ -Recurse -AccessRights GenericWrite -AllowPartialAccess</code> <para>Check recursively for accessible devices with partial write access.</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleDevice \Device -Recurse -Tokens $token -AccessRights GenericWrite</code> <para>Get all devices which can be written to in \Device by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.Path"> <summary> <para type="description">Specify a list of native paths to check. Can refer to object directories to search for device objects or explicit paths.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.Recurse"> <summary> <para type="description">Specify whether to recursively check the directories for devices.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.MaxDepth"> <summary> <para type="description">When recursing specify maximum depth.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.CheckMode"> <summary> <para type="description">Check mode for device and/or namespace.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.NamespacePath"> <summary> <para type="description">If check mode allows namespace paths specify a list of namespace paths to check for access to the device namespace instead of a default.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.CheckEaBuffer"> <summary> <para type="description">Check whether the device can be accessed with an EA buffer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.EaBuffer"> <summary> <para type="description">If CheckEaBuffer enabled specify an explicit buffer instead of a default.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.OpenOptions"> <summary> <para type="description">Specify open options for access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.NoImpersonation"> <summary> <para type="description">Specify not to use impersonation for access checks.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleDeviceCmdlet.BeginProcessing"> <summary> Override for begin processing. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.FileCheckMode"> <summary> <para type="description">Limit access check to specific types of files.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.FileCheckMode.All"> <summary> Check files and directories for access. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.FileCheckMode.FilesOnly"> <summary> Check files only. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.FileCheckMode.DirectoriesOnly"> <summary> Check directories only. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleFileCmdlet"> <summary> <para type="synopsis">Get a list of files that can be opened by a specified token.</para> <para type="description">This cmdlet checks a file or directory and tries to determine if one or more specified tokens can open them. If no tokens are specified the current process token is used.</para> </summary> <example> <code>Get-AccessibleFile \??\C:\Windows</code> <para>Check accessible file c:\Windows for the current process token.</para> </example> <example> <code>Get-AccessibleFile \??\C:\Windows -ProcessIds 1234,5678</code> <para>Check accessible file c:\Windows for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>Get-AccessibleFile \??\C:\Windows -Recurse</code> <para>Check recursively for check accessible files under c:\Windows for the current process token.</para> </example> <example> <code>Get-AccessibleFile -Win32Path C:\Windows -Recurse</code> <para>Check recursively for check accessible files under c:\Windows for the current process token using a Win32 path.</para> </example> <example> <code>Get-AccessibleFile -Win32Path C:\Windows -Recurse -MaxDepth 2</code> <para>Check recursively for check accessible files under c:\Windows for the current process token using a Win32 path with a max depth of 2.</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleFile \??\C:\Windows -Recurse -Tokens $token -AccessRights GenericWrite</code> <para>Get all files with can be written to \??\C:\Windows by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFileCmdlet.DirectoryAccess"> <summary> <para type="description">Specify a set of directory access rights which a directory must at least be accessible for to count as an access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleFileCmdlet.CheckMode"> <summary> <para type="description">Limit access check to specific types of files.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleFileCmdlet.ConvertWin32Path(System.String)"> <summary> Convert a Win32 Path to a Native NT path. </summary> <param name="win32_path">The win32 path to convert.</param> <returns>The native path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleFileCmdlet.BeginProcessing"> <summary> Override for begin processing. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleHandle"> <summary> <para type="synopsis">Get a list of accessible handles from a specified token.</para> <para type="description">This cmdlet enumerates all handles accessible from a specific token and checks and determines what the maximum access rights are for that handle.</para> </summary> <remarks>For best results this command should be run as an administrator.</remarks> <example> <code>Get-AccessibleHandle</code> <para>Check all accessible handles for the current process token.</para> </example> <example> <code>Get-AccessibleHandle -TypeFilter Key</code> <para>Check all accessible key handles for the current process token.</para> </example> <example> <code>Get-AccessibleHandle -ProcessIds 1234,5678</code> <para>>Check all accessible handles for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>Get-AccessibleHandle | Where-Object DifferentAccess</code> <para>Check all accessible handles for the current process token where the access differs from what the access would be if you reopened the resource</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleHandle.TypeFilter"> <summary> <para type="description">Specify list of NT object types to filter on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleHandle.QueryAllDevicePaths"> <summary> <para type="description">Specify to query all file device paths. Doing this might cause the cmdlet to hang.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleKeyCmdlet"> <summary> <para type="synopsis">Get a list of Registry Keys that can be opened by a specified token.</para> <para type="description">This cmdlet checks a registry key and tries to determine if one or more specified tokens can open them. If no tokens are specified the current process token is used.</para> </summary> <example> <code>Get-AccessibleKey \Registry\Machine\Software</code> <para>Check accessible keys \Registry\Machine\Software for the current process token.</para> </example> <example> <code>Get-AccessibleKey \Registry\Machine\Software -ProcessIds 1234,5678</code> <para>Check accessible keys \Registry\Machine\Software for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>Get-AccessibleKey \Registry\Machine\Software -Recurse</code> <para>Check recursively for accessible keys \Registry\Machine\Software for the current process token.</para> </example> <example> <code>Get-AccessibleKey \Registry\Machine\Software -Recurse -MaxDepth 5</code> <para>Check recursively for accessible keys \Registry\Machine\Software for the current process token to a maximum depth of 5.</para> </example> <example> <code>Get-AccessibleKey -Win32Path HKLM\Software -Recurse</code> <para>Check recursively for accessible keys NT path HKEY_LOCAL_MACHINE for the current process token using a Win32 path.</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleKey -Win32Path HKCU -Recurse -Tokens $token -AccessRights GenericWrite</code> <para>Get all keys with can be written to in HKEY_CURRENT_USER by a low integrity copy of current token.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleKeyCmdlet.BeginProcessing"> <summary> Override for begin processing. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleKeyCmdlet.ConvertWin32Path(System.String)"> <summary> Convert a Win32 Path to a Native NT path. </summary> <param name="win32_path">The win32 path to convert.</param> <returns>The native path.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleNamedPipeCmdlet"> <summary> <para type="synopsis">Get a list of named pipes that can be opened by a specified token.</para> <para type="description">This cmdlet checks for named pipes and tries to determine if one or more specified tokens can open them. If no tokens are specified the current process token is used.</para> </summary> <example> <code>Get-AccessibleNamedPipe</code> <para>Check accessible named pipes for the current process token.</para> </example> <example> <code>Get-AccessibleNamedPipe -OpenServer</code> <para>Check accessible named pipes server end points which can be opened for the current process token.</para> </example> <example> <code>Get-AccessibleNamedPipe -ProcessIds 1234,5678</code> <para>Check accessible named pipes for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleNamedPipes -Tokens $token -AccessRights GenericWrite</code> <para>Get all named pipes with can be written to by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleNamedPipeCmdlet.FormatWin32Path"> <summary> <para type="description">When generating the results format path in Win32 format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleNamedPipeCmdlet.OpenServer"> <summary> <para type="description">Try and open the server end rather than the client end of the pipe.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet"> <summary> <para type="synopsis">Get a list of NT objects that can be opened by a specified token.</para> <para type="description">This cmdlet checks a NT object key and optionally tries to determine if one or more specified tokens can open them. If no tokens are specified the current process token is used.</para> </summary> <example> <code>Get-AccessibleObject \BaseNamedObjects</code> <para>Check accessible objects under \ for the current process token.</para> </example> <example> <code>Get-AccessibleObject \BaseNamedObjects -ProcessIds 1234,5678</code> <para>Check accessible objects under \BaseNamedObjects for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>Get-AccessibleObject \BaseNamedObjects -Recurse</code> <para>Check recursively for accessible objects under \BaseNamedObjects for the current process token.</para> </example> <example> <code>Get-AccessibleObject \BaseNamedObjects -Recurse -MaxDepth 5</code> <para>Check recursively for accessible objects under \BaseNamedObjects for the current process token to a maximum depth of 5.</para> </example> <example> <code>Get-AccessibleObject -Win32Path \ -Recurse</code> <para>Check recursively for accessible objects under the user's based named objects for the current process token.</para> </example> <example> <code>Get-AccessibleObject \ -Recurse -AccessRights GenericWrite</code> <para>Check recursively for accessible objects under with write access.</para> </example> <example> <code>Get-AccessibleObject \ -Recurse -AccessRights GenericWrite -AllowPartialAccess</code> <para>Check recursively for accessible objects under with partial write access.</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleObject \BaseNamedObjects -Recurse -Tokens $token -AccessRights GenericWrite</code> <para>Get all object which can be written to in \BaseNamedObjects by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet.TypeFilter"> <summary> <para type="description">Specify list of NT object types to filter on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet.FromHandle"> <summary> <para type="description">Specify to find objects based on handles rather than enumerating named paths.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet.CheckUnnamed"> <summary> <para type="description">Specify when enumerating handles to also check unnamed objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet.QueryAllDevicePaths"> <summary> <para type="description">Specify to query all file device paths. Doing this might cause the cmdlet to hang.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Accessible.GetAccessibleObjectCmdlet.ConvertWin32Path(System.String)"> <summary> Convert a Win32 Path to a Native NT path. </summary> <param name="win32_path">The win32 path to convert.</param> <returns>The native path.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult"> <summary> <para type="description">Access check result for a process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.ProcessImagePath"> <summary> Process image path. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.ProcessId"> <summary> Process ID of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.ProcessCommandLine"> <summary> Command line of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.SessionId"> <summary> Session ID of the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.IsThread"> <summary> Gets whether this is a thread access check result. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.User"> <summary> Gets the user SID for the process. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ProcessAccessCheckResult.IsDead"> <summary> Gets whether the process was dead. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ThreadAccessCheckResult"> <summary> Access check result for a thread. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ThreadAccessCheckResult.ThreadId"> <summary> Thread ID of the thread. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.ThreadAccessCheckResult.ThreadDescription"> <summary> Thread description if available. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.ProcessCheckMode"> <summary> <para type="description">Specify what objects to query for.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ProcessCheckMode.ProcessOnly"> <summary> Only check processes </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ProcessCheckMode.ThreadOnly"> <summary> Only check threads. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Accessible.ProcessCheckMode.ProcessAndThread"> <summary> Check both processes and threads. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleProcessCmdlet"> <summary> <para type="synopsis">Get a list of processes and/or threads that can be opened by a specified token.</para> <para type="description">This cmdlet checks all processes and threads and tries to determine if one or more specified tokens can open them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>For best results this command should be run as an administrator with SeDebugPrivilege.</remarks> <example> <code>Get-AccessibleProcess</code> <para>Check all accessible processes for the current process token.</para> </example> <example> <code>Get-AccessibleProcess -ProcessIds 1234,5678</code> <para>>Check all accessible processes for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleProcess -Tokens $token -AccessRights GenericWrite</code> <para>Get all processes with can be written by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleProcessCmdlet.CheckMode"> <summary> <para type="description">Specify what objects to check for.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleProcessCmdlet.ThreadAccess"> <summary> <para type="description">Specify specific access rights for threads.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleProcessCmdlet.ShowDeadProcesses"> <summary> <para type="description">Specify that dead processes should be shown.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet"> <summary> <para type="synopsis">Get a list of services openable by a specified token.</para> <para type="description">This cmdlet checks all services and tries to determine if one or more specified tokens can open them. If no tokens are specified then the current process token is used.</para> </summary> <remarks>For best results this command should be run as an administrator.</remarks> <example> <code>Get-AccessibleService</code> <para>Check all accessible services for the current process token.</para> </example> <example> <code>Get-AccessibleService -CheckScmAccess</code> <para>Check access to the SCM for the current process token.</para> </example> <example> <code>Get-AccessibleService -CheckFiles</code> <para>Check all accessible services for the current process token as well as generating access checks for the services files.</para> </example> <example> <code>Get-AccessibleService -ProcessIds 1234,5678</code> <para>>Check all accessible services for the process tokens of PIDs 1234 and 5678</para> </example> <example> <code>$token = Get-NtToken -Primary -Duplicate -IntegrityLevel Low
Get-AccessibleService -Tokens $token -AccessRights GenericWrite</code> <para>Get all services which can be written by a low integrity copy of current token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.Name"> <summary> <para type="description">Specify names of services to check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.CheckScmAccess"> <summary> <para type="description">Check access to the SCM.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.ScmAccess"> <summary> <para type="description">Specify access mask for access to the SCM.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.CheckMode"> <summary> <para type="description">Check mode for accessible services.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.IgnoreTrigger"> <summary> <para type="description">Ignore triggers when checking maximum access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Accessible.GetAccessibleServiceCmdlet.CheckFiles"> <summary> <para type="description">Check for writable service files and directories.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.CompareNtSecurityDescriptorCmdlet"> <summary> <para type="synopsis">Compare two security descriptors against each other.</para> <para type="description">This cmdlet compares two security descriptors against each other. Returns a boolean result.</para> </summary> <example> <code>Compare-NtSecurityDescriptor $sd1 $sd2</code> <para>Checks both security descriptors are equal.</para> </example> <example> <code>Compare-NtSecurityDescriptor $sd1 $sd2 -Report</code> <para>Checks both security descriptors are equal and report the differences.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSecurityDescriptorCmdlet.Left"> <summary> <para type="description">Specify the left security descriptor to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSecurityDescriptorCmdlet.Right"> <summary> <para type="description">Specify the right security descriptor to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSecurityDescriptorCmdlet.Report"> <summary> <para type="description">Specify to print what differs between the two security descriptors if they do not match.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.CompareNtSecurityDescriptorCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.ConvertToNtSecurityDescriptorCmdlet"> <summary> <para type="synopsis">Converts from a .NET ACL to a NT security descriptor.</para> <para type="description">This cmdlet converts an existing .NET ACL (such as from Get-Acl) and creates a security descriptor object.</para> </summary> <example> <code>Get-Acl $env:WinDir | ConvertTo-NtSecurityDescriptor</code> <para>Converts the ACL for the windows directory to an NT security descriptor.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConvertToNtSecurityDescriptorCmdlet.InputObject"> <summary> <para type="description">The .NET security descriptor.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.ConvertToNtSecurityDescriptorCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase"> <summary> Base class for the granted access cmdlets. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.RawAccess"> <summary> <para type="description">Specify an access mask to check against. Overrides GenericAccess.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.Token"> <summary> <para type="description">Specify a token object to do the access check against. If not specified then current effective token is used.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.MapToGeneric"> <summary> <para type="description">Specify whether to map the access mask back to generic rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.AsString"> <summary> <para type="description">Specify whether to return a string rather than an enumeration value.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.AsSDKString"> <summary> <para type="description">Specify whether to return a string using SDK style names.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.Principal"> <summary> <para type="description">Specify a principal SID to user when checking security descriptors with SELF SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.PassResult"> <summary> <para type="description">Specify to return the access check result rather than get the granted access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.ResultList"> <summary> <para type="description">Specify to return the access check results as a list. Can only be used with Object Types.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.ObjectType"> <summary> <para type="description">Specify object types for access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.Audit"> <summary> <para type="description">Specify to enable auditing for this access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.Container"> <summary> <para type="description">Specify if the type is a container..</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.GetSecurityDescriptor"> <summary> Abstract method to get the security descriptor for access checking. </summary> <returns>The security descriptor.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.GetNtType"> <summary> Abstract method to get the NT type for the access check. </summary> <returns>The NT type.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetGrantedAccessCmdletBase.ProcessRecord"> <summary> Overridden process record method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet"> <summary> <para type="synopsis">Create a new enclave.</para> <para type="description">This cmdlet creates a new enclave.</para> </summary> <example> <code>$ev = New-NtEnclave -VBS -Size 0x1000000 -InitialImageFile "secure.dll"</code> <para>Create a VBS enclave in the current process.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet.Process"> <summary> <para type="description">Specify to process to create the enclave in.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet.VBSFlags"> <summary> <para type="description">Specify the VBS enclave flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet.OwnerId"> <summary> <para type="description">Specify the VBS enclave owner ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet.ImageFile"> <summary> <para type="description">Specify the primary image file to load in the enclave.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtEnclaveCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.AddNtDebugProcessCmdlet"> <summary> <para type="synopsis">Attach a process to a debug object.</para> <para type="description">This cmdlet attaches a process to a debug object. You can remove it again using Remove-NtDebugProcess.</para> </summary> <example> <code>Add-NtDebugProcess $dbg -ProcessId 12345</code> <para>Attach process 12345 to the debug object..</para> </example> <example> <code>Add-NtDebugProcess $dbg -Process $proc</code> <para>Attach a process object to the debug object..</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtDebugProcessCmdlet.DebugObject"> <summary> <para type="description">Specify the debug object to attach the process to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtDebugProcessCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to attach to .</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtDebugProcessCmdlet.Process"> <summary> <para type="description">Specify a process to attach to.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtDebugProcessCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet"> <summary> <para type="synopsis">Loads a new registry hive.</para> <para type="description">This cmdlet loads a registry hive to somewhere in the registry namespace. If the hive file doesn't exist it will be created.</para> </summary> <example> <code>$token = Get-NtTokenPrimary
$token.SetPrivilege("SeRestorePrivilege", $true)
$obj = Add-NtKeyHive \??\C:\Windows\Temp\test.hiv \Registry\Machine\ABC</code> <para>Load a hive to a new attachment point.</para> </example> <example> <code>$obj = Add-NtKeyHive \??\C:\Windows\Temp\test.hiv \Registry\A\ABC -LoadFlags AppKey</code> <para>Load a app hive to a new attachment point (can be done without privileges).</para> </example> <example> <code>$obj = Add-NtKeyHive \??\C:\Windows\Temp\test.hiv \Registry\A\ABC -LoadFlags AppKey,ReadOnly</code> <para>Load a app hive to a new attachment point read-only.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.Path"> <summary> <para type="description">The path to the hive file to add.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.KeyPath"> <summary> <para type="description">Specifes the native path to where the hive should be loaded.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.LoadFlags"> <summary> <para type="description">Specifes the flags for loading the hive.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.Token"> <summary> <para type="description">Specifes the token to impersonate for loading the hive.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.TrustKey"> <summary> <para type="description">Specifes the key that this new hive should trust.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.Event"> <summary> <para type="description">Specifes an event for the hive load.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.NoOpen"> <summary> <para type="description">Specifes to not open the root key when loading a normal hive.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.ResolvePath"> <summary> Virtual method to return the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtKeyHiveCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet"> <summary> <para type="synopsis">Adds an ACE to a security descriptor.</para> <para type="description">This cmdlet adds an ACE to the specified security descriptor. It will automatically select the DACL or SACL depending on the ACE type requested. It also supports specifying a Condition for callback ACEs and Object GUIDs for Object ACEs. The Access property changes behavior depending on the NtType property of the Security Descriptor. </para> </summary> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll</code> <para>Add Allowed ACE to DACL with Generic All access for the Everyone group.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -MapGeneric</code> <para>Add Allowed ACE to DACL with Generic All access for the Everyone group and map the generic rights.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -Type Audit</code> <para>Add Audit ACE to SACL with Generic All access for the Everyone group.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -Flags ObjectInherit, InheritOnly</code> <para>Add Allowed ACE to DACL with Generic All access for the Everyone group with Object Inherity and InheritOnly flags.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -Type Denied</code> <para>Add Denied ACE to DACL with Generic All access for the Everyone group.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -Type AllowedCallback -Condition 'APPID://PATH Contains "*"'</code> <para>Add Allowed ACE to DACL with a condition.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -Access GenericAll -Type AllowedObject -ObjectType "{AD39A509-02C7-4E9A-912A-A51168C10A4C}"</code> <para>Add Allowed Object ACE to DACL with an object type.</para> </example> <example> <code>Add-NtSecurityDescriptorAce $sd -Sid "WD" -ServerSid "BA" -Access GenericAll -Type AllowedCompound</code> <para>Add Allowed Compound ACE to DACL with with Administrators SID as the Server SID.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.SecurityDescriptor"> <summary> <para type="description">Specify to create the security descriptor with a NULL DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.Sid"> <summary> <para type="description">Specify to add ACE with SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.Name"> <summary> <para type="description">Specify to add ACE from a user/group name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.KnownSid"> <summary> <para type="description">Specify to add ACE a known SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.Type"> <summary> <para type="description">Specify the type of ACE.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.Flags"> <summary> <para type="description">Specify the ACE flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.PassThru"> <summary> <para type="description">Return the ACE added from the operation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.RawAccess"> <summary> <para type="description">Specify a raw access mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.MapGeneric"> <summary> <para type="description">Map generic access based on the NtType of the SD.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtSecurityDescriptorAceCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet"> <summary> <para type="synopsis">Add an APC to a thread.</para> <para type="description">This cmdlet queues an APC to a thread.</para> </summary> <example> <code>Add-NtThreadApc -Thread $th -ApcRoutine $addr -Argument1 1234</code> <para>Queue a thread APC for $addr.</para> </example> <example> <code>Add-NtThreadApc -Thread $th -ApcRoutine $addr -Argument1 1234 -Special</code> <para>Queue a thread special APC for $addr.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.Thread"> <summary> <para type="description">Specify the thread to queue the APC to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.ApcRoutine"> <summary> <para type="description">Specify the address of the APC callback.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.ScriptBlock"> <summary> <para type="description">Specify a script block to run in the current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.Argument1"> <summary> <para type="description">Specify the first argument for the APC callback.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.Argument2"> <summary> <para type="description">Specify the first argument for the APC callback.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.Argument3"> <summary> <para type="description">Specify the first argument for the APC callback.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.Special"> <summary> <para type="description">Specify to queue a special APC.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtThreadApcCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet"> <summary> <para type="synopsis">Adds or replaces security attributes on an NT token.</para> <para type="description">This cmdlet adds or replaces security attributes on an NT token. It needs SeTcbPrivilege to succeed.</para> </summary> <example> <code>Add-NtTokenSecurityAttribute -Token $token -Name "TEST://ME" -StringValue "ABC"</code> <para>Adds the security attribute TEST://ME with the string value "ABC".</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.Token"> <summary> <para type="description">Specify the token to set the attributes on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.Name"> <summary> <para type="description">Specify the name of the attribute to add or update.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.Flags"> <summary> <para type="description">Specify the attribute flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.Replace"> <summary> <para type="description">Specify to replace the security attribute.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.StringValue"> <summary> <para type="description">Specify the string values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.ULongValue"> <summary> <para type="description">Specify the ulong values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.LongValue"> <summary> <para type="description">Specify the long values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.BoolValue"> <summary> <para type="description">Specify the bool values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.SidValue"> <summary> <para type="description">Specify the SID values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.FqbnValue"> <summary> <para type="description">Specify the fully qualified binary name values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.OctetValue"> <summary> <para type="description">Specify the octet values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.Attribute"> <summary> <para type="description">Specify existing attribute values.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.AddNtTokenSecurityAttributeCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2"> <summary> Base class for child object visitor. </summary> <typeparam name="O">The type of NT object.</typeparam> <typeparam name="A">The access rights type.</typeparam> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.Object"> <summary> <para type="description">Specify an object to get children from, should be a directory.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.Access"> <summary> <para type="description">Specify the access when opening a child.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.Recurse"> <summary> <para type="description">Get children recursively.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.MaxDepth"> <summary> <para type="description">When recursing specify the maximum depth of recursion. -1 indicates no limit.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.Visitor"> <summary> <para type="description">Specify a script block to run for every child. The file object will automatically be disposed once the vistor has executed. If you want to cancel enumeration return $false.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.Filter"> <summary> <para type="description">Specify a script block to filter child objects. Return $true to keep the object.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.VisitChildObjects(System.Func{`0,System.Boolean})"> <summary> Function to visit child objects. </summary> <param name="visitor">The visitor function to execute.</param> <returns>True if visited all children, false if cancelled.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.BaseGetNtChildObjectCmdlet`2.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet"> <summary> Base class for querying or setting a property on a file object. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.File"> <summary> <para type="description">Specify the file to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.Path"> <summary> <para type="description">Specify the path to the file to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.Win32Path"> <summary> <para type="description">Specify to specify the path as a Win32 path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.CaseSensitive"> <summary> <para type="description">Specify to open the path case sensitively.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.OpenReparsePoint"> <summary> <para type="description">Specify to open the reparse point.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.OpenForBackupIntent"> <summary> <para type="description">Specify to open the path with backup privileges.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.BaseNtFilePropertyCmdlet.ProcessRecord"> <summary> Overridden process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet"> <summary> <para type="synopsis">Connects to an ALPC server by path.</para> <para type="description">This cmdlet connects to an existing NT ALPC server. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter (if running on Win8+).</para> </summary> <example> <code>$obj = Connect-NtAlpcClient "\RPC Control\ABC"</code> <para>Connect to an ALPC object with an absolute path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.HandleObjectAttributes"> <summary> <para type="description">Optional object attributes for the handle.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.PortAttributes"> <summary> <para type="description">Optional port attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.Flags"> <summary> <para type="description">Flags for sending the initial message.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.RequiredServerSid"> <summary> <para type="description">Optional SID to verify the server's identity.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.ServerSecurityRequirements"> <summary> <para type="description">Optional security descriptor to verify the server's identity.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.ConnectionMessage"> <summary> <para type="description">Optional initial connection message.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.OutMessageAttributes"> <summary> <para type="description">Optional outbound message attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.InMessageAttributes"> <summary> <para type="description">Optional inbound message attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcClientCmdlet.Timeout"> <summary> <para type="description">Optional connection timeout.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet"> <summary> <para type="synopsis">Accepts a connection on an ALPC server port.</para> <para type="description">This cmdlet accepts a connection on an ALPC server port and returns the new server port to communicate with the client.</para> </summary> <example> <code>$conn = Connect-NtAlpcServer -Port $port -ConnectionMessage $msg</code> <para>Accepts a connection on an ALPC server port.</para> </example> <example> <code>$conn = Connect-NtAlpcServer -Port $port -ConnectionMessage $msg -Reject</code> <para>Reject a connection on an ALPC server port.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.Port"> <summary> <para type="description">The server port to accept the connection.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.ConnectionMessage"> <summary> <para type="description">Initial connection message from the initial receive call.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.PortContext"> <summary> <para type="description">Optional context value for the new port.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.PortAttributes"> <summary> <para type="description">Optional port attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.Flags"> <summary> <para type="description">Flags for sending the initial message.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.ConnectionAttributes"> <summary> <para type="description">Optional connection message attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ConnectNtAlpcServerCmdlet.Reject"> <summary> <para type="description">Specify to reject the client connection.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet"> <summary> <para type="synopsis">Duplicate an object to a new handle. Optionally specify processes to duplicate to.</para> <para type="description">This cmdlet duplicates an object either in the same process or between processes. If you duplicate to another process the cmdlet will return a handle value rather than an object. </para> </summary> <example> <code>Copy-NtObject -Object $obj</code> <para>Duplicate an object to another in the current process with same access rights.</para> </example> <example> <code>Copy-NtObject -Object $obj -DestinationProcess $proc</code> <para>Duplicate an object to another process. If the desintation process is the current process an object is returned, otherwise a handle is returned.</para> </example> <example> <code>Copy-NtObject -SourceHandle 1234 -SourceProcess $proc</code> <para>Duplicate an object from another process to the current process.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.Object"> <summary> <para type="description">Specify the object to duplicate in the current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.Handle"> <summary> <para type="description">Specify the object to duplicate in the current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.SourceHandle"> <summary> <para type="description">Specify the object to duplicate as a handle.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.SourceProcess"> <summary> <para type="description">Specify the process to duplicate from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.DestinationProcess"> <summary> <para type="description">Specify the process to duplicate to. Defaults to current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.DesiredAccess"> <summary> <para type="description">The desired access for the duplication.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.DesiredAccessMask"> <summary> <para type="description">The desired access for the duplication as an access mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.NoRightsUpgrade"> <summary> <para type="description">Specify the no rights upgrade flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.ObjectAttributes"> <summary> <para type="description">The desired object attribute flags for the duplication.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.CloseSource"> <summary> <para type="description">Close the source handle.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.CopyNtObjectCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.DbgContinueStatus"> <summary> <para type="description">The allowed set of continue status</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_EXCEPTION_HANDLED"> <summary> Exception is handled. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_CONTINUE"> <summary> Continue thread. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_EXCEPTION_NOT_HANDLED"> <summary> Exception not handled. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_REPLY_LATER"> <summary> Reply later to the debug event. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_TERMINATE_THREAD"> <summary> Terminate the thread being debugged. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.DbgContinueStatus.DBG_TERMINATE_PROCESS"> <summary> Terminate the process being debugged. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet"> <summary> <para type="synopsis">Convert a specific object access to an AccessMask or GenericAccess.</para> <para type="description">This cmdlet allows you to convert a specific object access to an AccessMask or GenericAccess for use in general functions.</para> </summary> <example> <code>Get-NtAccessMask -ProcessAccess DupHandle</code> <para>Get the Process DupHandle access right as an AccessMask</para> </example> <example> <code>Get-NtAccessMask -ProcessAccess DupHandle -AsGenericAccess</code> <para>Get the Process DupHandle access right as a GenericAccess value</para> </example> <example> <code>Get-NtAccessMask -AccessMask 0xFF -AsTypeAccess Process</code> <para>Convert a raw access mask to a process access mask.</para> </example> <example> <code>Get-NtAccessMask -AccessControlEntry $sd.Dacl[0] -AsTypeAccess Thread</code> <para>Get the access mask from a security descriptor ACE and map to thread access.</para> </example> <example> <code>$sd.Dacl | Get-NtAccessMask -AsTypeAccess Thread</code> <para>Get the access mask from a list of security descriptor ACEs and map to thread access.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AccessMask"> <summary> <para type="description">Specify a raw access mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.FileAccess"> <summary> <para type="description">Specify File access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.FileDirectoryAccess"> <summary> <para type="description">Specify File Directory access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.IoCompletionAccess"> <summary> <para type="description">Specify IO Completion access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.MutantAccess"> <summary> <para type="description">Specify Mutant access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.SemaphoreAccess"> <summary> <para type="description">Specify Semaphore access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.RegistryTransactionAccess"> <summary> <para type="description">Specify Registry Transaction access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AlpcPortAccess"> <summary> <para type="description">Specify ALPC Port access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.SectionAccess"> <summary> <para type="description">Specify Section access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.KeyAccess"> <summary> <para type="description">Specify Key access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.EventAccess"> <summary> <para type="description">Specify Event access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.SymbolicLinkAccess"> <summary> <para type="description">Specify Symbolic Link access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.TokenAccess"> <summary> <para type="description">Specify Token access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.GenericAccess"> <summary> <para type="description">Specify Generic access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.DirectoryAccess"> <summary> <para type="description">Specify Directory access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ThreadAccess"> <summary> <para type="description">Specify Thread access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.DebugObjectAccess"> <summary> <para type="description">Specify Debug Object access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.JobAccess"> <summary> <para type="description">Specify Job access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ProcessAccess"> <summary> <para type="description">Specify Process access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.TransactionAccess"> <summary> <para type="description">Specify transaction access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.TransactionManagerAccess"> <summary> <para type="description">Specify transaction manager access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ResourceManagerAccess"> <summary> <para type="description">Specify resource manager access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.EnlistmentAccess"> <summary> <para type="description">Specify enlistment access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ServiceAccess"> <summary> <para type="description">Specify service access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ServiceControlManagerAccess"> <summary> <para type="description">Specify service control manager access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ManadatoryLabelPolicy"> <summary> <para type="description">Specify mandatory label policy.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AccessControlEntry"> <summary> <para type="description">Specify an ACE to extract the mask to map.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.SecurityInformation"> <summary> <para type="description">Specify a security information to get the access mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.SetSecurity"> <summary> <para type="description">Specify to get the set security mask rather than the query.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsGenericAccess"> <summary> <para type="description">Return access as GenericAccess.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsMandatoryLabelPolicy"> <summary> <para type="description">Return access as ManadatoryLabelPolicy.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsSpecificAccess"> <summary> <para type="description">Return access as specific access type based on the type enumeration.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsTypeAccess"> <summary> <para type="description">Return access as specific access type based on the NtType object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.MapGenericRights"> <summary> <para type="description">Specify that any generic rights should be mapped to type specific rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.GenericMapping"> <summary> <para type="description">When specifying a Mandatory Label Policy specify GenericMapping to get the mandatory access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsString"> <summary> <para type="description">Specify to output the access mask a string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.AsSDKString"> <summary> <para type="description">Specify to output the access mask a string, using SDK names if available.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtAccessMaskCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet"> <summary> <para type="synopsis">Open a NT debug object by path.</para> <para type="description">This cmdlet opens an existing NT debug object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtDebug \BaseNamedObjects\ABC</code> <para>Get a debug object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtDebug ABC -Root $root</code> <para>Get a debug object with a relative path. </para> </example> <example> <code>$obj = Get-NtDebug -Path \BaseNamedObjects\ABC
$obj.Wait()</code> <para>Get a debug object, wait for it to be set.</para> </example> <example> <code>$obj = Get-NtDebug -Path \BaseNamedObjects\ABC
$obj.Set()</code> <para>Get a debug object, and set it.</para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtDebug ABC</code> <para>Get a debug object with a relative path based on the current location. </para> </example> <example> <code>Get-NtDebug -Current</code> <para>Get the current debug object. </para> </example> <example> <code>Get-NtDebug -Process $p</code> <para>Get the debug object from a process. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet.Current"> <summary> <para type="description">Open the current thread's debug object. Most parameters on this cmdlet will be ignored.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet.Process"> <summary> <para type="description">Open the debug object from a process. Most parameters on this cmdlet will be ignored.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDebugCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet"> <summary> <para type="synopsis">Open a Desktop object by path.</para> <para type="description">This cmdlet opens an existing Desktop object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtDesktop</code> <para>Get all accessible Desktops.</para> </example> <example> <code>$obj = Get-NtDesktop \Windows\WindowStations\WinSta0\Default</code> <para>Get an desktop object with an absolute path.</para> </example> <example> <code>$winsta = Get-NtWindowStation -Current
$obj = Get-NtDesktop ABC -Root $root</code> <para>Get an Desktop object with a relative path. </para> </example> <example> <code>$obj = Get-NtDesktop -Path Default -Win32Path</code> <para>Get the Default Desktop object in current Window Station.</para> </example> <example> <code>$obj = Get-NtDesktop -Path blah\Default -Win32Path</code> <para>Get the Default Desktop object in blah Window Station.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.Current"> <summary> <para type="description">The current Desktop.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDesktopCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtDirectoryCmdlet"> <summary> <para type="synopsis">Open a NT object directory.</para> <para type="description">This cmdlet opens an existing NT object directory. It's possible to open a directory by its NT path, such as \Some\Path or it can also open a private namespace which isn't represented by an accessible NT path but instead uses a boundary descriptor.</para> </summary> <example> <code>$obj = Get-NtDirectory \BaseNamedObjects</code> <para>Get a directory object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtDirectory ABC -Root $root</code> <para>Get a directory object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtDirectory ABC</code> <para>Get a directory object with a relative path based on the current location. </para> </example> <example> <code>$obj = Get-NtDirectory -Path \BaseNamedObjects
$obj.Query()</code> <para>Get a directory object and query its list of entries.</para> </example> <example> <code>$obj = Get-NtDirectory -PrivateNamespaceDescriptor WD:LW@ABC</code> <para>Get a private namespace directory object with Everyone and Low Mandatory Level SIDs and name ABC.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> <para type="link">https://msdn.microsoft.com/en-us/library/windows/desktop/ms684318(v=vs.85).aspx</para> <para type="link">https://msdn.microsoft.com/en-us/library/windows/desktop/ms682121(v=vs.85).aspx</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDirectoryCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtDirectoryCmdlet.PrivateNamespaceDescriptor"> <summary> <para type="description">A string format of a private namespace boundary descriptor. Uses the form [SID[:SID...]@]NAME where SID is an SDDL version of a SID to add to the boundary (such as S-X-X-X or WD) and NAME is the arbitrary name. </para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDirectoryCmdlet.ResolvePath"> <summary> Virtual method to resolve the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDirectoryCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtEnlistmentCmdlet"> <summary> <para type="synopsis">Open a NT Enlistment object or all from a Resource Manager.</para> <para type="description">This cmdlet opens an existing NT Enlistment object or all from a Resource Manager.</para> </summary> <example> <code>$obj = Get-NtEnlistment -ResourceManager $rm</code> <para>Get all Enlistment objects from a Resource Manager.</para> </example> <example> <code>$obj = Get-NtEnlistment -EnlistmentGuid '04422e91-63c2-4025-944d-d66fae133274' -ResourceManager $rm</code> <para>Get a Enlistment object from its GUID and Resource Manager.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtEnlistmentCmdlet.EnlistmentGuid"> <summary> <para type="description">Specify the Enlistment GUID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtEnlistmentCmdlet.ResourceManager"> <summary> <para type="description">Specify the Transaction Manager containing the Resource Manager.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtEnlistmentCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtEventCmdlet"> <summary> <para type="synopsis">Open a NT event object by path.</para> <para type="description">This cmdlet opens an existing NT event object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtEvent \BaseNamedObjects\ABC</code> <para>Get an event object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtEvent ABC -Root $root</code> <para>Get an event object with a relative path. </para> </example> <example> <code>$obj = Get-NtEvent -Path \BaseNamedObjects\ABC
$obj.Wait()</code> <para>Get an event object, wait for it to be set.</para> </example> <example> <code>$obj = Get-NtEvent -Path \BaseNamedObjects\ABC
$obj.Set()</code> <para>Get an event object, and set it.</para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtEvent ABC</code> <para>Get an event object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtEventCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtEventCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtEventCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileAttributeCmdlet"> <summary> <para type="synopsis">Get the file attributes for a file.</para> <para type="description">This cmdlet gets the file attributes for a file.</para> </summary> <example> <code>Get-NtFileAttribute -File $f</code> <para>Get the file attributes for the file.</para> </example> <example> <code>Get-NtFileAttribute -Path "\??\c:\windows\notepad.exe"</code> <para>Get the file attributes for the file by path</para> </example> <example> <code>Get-NtFileAttribute -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the file attributes for the file by win32 path</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileAttributeCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet"> <summary> <para type="synopsis">Open a existing NT file object.</para> <para type="description">This cmdlet opens a existing NT file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simply calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>$obj = Get-NtFile \??\C:\Windows\Notepad.exe</code> <para>Open a file object with an absolute path.</para> </example> <example> <code>$root = Get-NtFile \??\C:\Windows
$obj = Get-NtFile Notepad.exe -Root $root</code> <para>Open a file object with a relative path.</para> </example> <example> <code>$obj = Get-NtFile c:\Windows\Notepad.exe -Win32Path</code> <para>Open a file object with an absolute win32 path.</para> </example> <example> <code>$obj = Get-NtFile ..\..\..\Windows\Notepad.exe -Win32Path</code> <para>Open a file object with a relative win32 path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.DeviceGuid"> <summary> <para type="description">Specify that the path is a device GUID not a full path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.OpenById"> <summary> <para type="description">Specify the path is a file id, in string format (e.g. 12345678) or a GUID object id.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.DirectoryAccess"> <summary> <para type="description">Specify file access using directory access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.ShareMode"> <summary> <para type="description">The access share mode to open the file with.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.Options"> <summary> <para type="description">The options to open the file with.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.Transaction"> <summary> <para type="description">Specify a transaction to create the file under.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.GetBasePath"> <summary> Get the base object manager path for the current powershell directory. </summary> <returns>The base path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.ResolvePath"> <summary> Virtual method to resolve the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.IsRawPath"> <summary> Indicates that the path is raw and should be passed through Base64 decode. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileCompressionCmdlet"> <summary> <para type="synopsis">Get the compression format for a file.</para> <para type="description">This cmdlet gets the compression format for a file.</para> </summary> <example> <code>Get-NtFileCompression -File $f</code> <para>Get the compression format for the file.</para> </example> <example> <code>Get-NtFileCompression -Path "\??\c:\windows\notepad.exe"</code> <para>Get the compression format for the file by path</para> </example> <example> <code>Get-NtFileCompression -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the compression format for the file by win32 path</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileCompressionCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileIdCmdlet"> <summary> <para type="synopsis">Get the file ID for a file.</para> <para type="description">This cmdlet gets the file ID for a file.</para> </summary> <example> <code>Get-NtFileId -File $f</code> <para>Get the file ID for the file.</para> </example> <example> <code>Get-NtFileId -Path "\??\c:\windows\notepad.exe"</code> <para>Get the file ID for the file by path</para> </example> <example> <code>Get-NtFileId -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the file ID for the file by win32 path</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileIdCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileLinkCmdlet"> <summary> <para type="synopsis">Get link names for a file.</para> <para type="description">This cmdlet gets a list of link names to a file.</para> </summary> <example> <code>Get-NtFileLink -File $f</code> <para>Get the links for the file.</para> </example> <example> <code>Get-NtFileLink -Path "\??\c:\windows\notepad.exe"</code> <para>Get the links for the file by path.</para> </example> <example> <code>Get-NtFileLink -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the links for the file by win32 path.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileLinkCmdlet.FormatWin32Path"> <summary> <para type="description">Specify to format the links as Win32 paths.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileLinkCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileObjectIdCmdlet"> <summary> <para type="synopsis">Get the object ID for a file.</para> <para type="description">This cmdlet gets the object ID for a file.</para> </summary> <example> <code>Get-NtFileObjectId -File $f</code> <para>Get the object ID for the file.</para> </example> <example> <code>Get-NtFileObjectId -Path "\??\c:\windows\notepad.exe"</code> <para>Get the object ID for the file by path</para> </example> <example> <code>Get-NtFileObjectId -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the object ID for the file by win32 path</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileObjectIdCmdlet.ExtendedInformation"> <summary> <para type="description">Specify to get extended object ID information.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileObjectIdCmdlet.Create"> <summary> <para type="description">Specify to create the object ID if it doesn't already exist.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileObjectIdCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileFinalPathCmdlet"> <summary> <para type="synopsis">Get the final path name for a file.</para> <para type="description">This cmdlet gets the final pathname for a file.</para> </summary> <example> <code>Get-NtFileFinalPath -File $f</code> <para>Get the path for the file.</para> </example> <example> <code>Get-NtFileFinalPath -Path "\??\c:\windows\notepad.exe"</code> <para>Get the path for the file by path.</para> </example> <example> <code>Get-NtFileFinalPath -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the path for the file by win32 path.</para> </example> <example> <code>Get-NtFileFinalPath -Path "\??\c:\windows\notepad.exe" -FormatWin32Path</code> <para>Get the path as a win32 path.</para> </example> <example> <code>Get-NtFileFinalPath -Path "\??\c:\windows\notepad.exe" -FormatWin32Path -Flags NameGuid</code> <para>Get the path as a volume GUID win32 path.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileFinalPathCmdlet.FormatWin32Path"> <summary> <para type="description">Specify to format the links as Win32 paths.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileFinalPathCmdlet.Flags"> <summary> <para type="description">Specify the name format when formatting as a Win32 path.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileFinalPathCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileReparsePointCmdlet"> <summary> <para type="synopsis">Open and reads the reparse point buffer for file.</para> <para type="description">This cmdlet opens a existing NT file object and reads out the reparse point buffer data. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>$obj = Get-NtFileReparsePoint \??\C:\XYZ</code> <para>Reads the reparse point with an absolute path.</para> </example> <example> <code>$root = Get-NtFile \??\C:\
$obj = Get-NtFileReparsePoint XYZ -Root $root</code> <para>Reads the reparse point with a relative path.</para> </example> <example> <code>$obj = Get-NtFileReparsePoint C:\XYZ -Win32Path</code> <para>Reads the reparse point with an absolute win32 path.</para> </example> <example> <code>$obj = Get-NtFileReparsePoint ..\..\..\XYZ -Win32Path</code> <para>Reads the reparse point with a relative win32 path.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileReparsePointCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileReparsePointCmdlet.Bytes"> <summary> <para type="description">Specify reading the reparse point data as a raw byte array.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileReparsePointCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileShareProcessCmdlet"> <summary> <para type="synopsis">Get the list of processes which are sharing this file.</para> <para type="description">This cmdlet gets the list of processes which are sharing this file.</para> </summary> <example> <code>Get-NtFileShareProcess -File $f</code> <para>Get the sharing processes for the file.</para> </example> <example> <code>Get-NtFileShareProcess -Path "\??\C:\windows\system32\kernel32.dll"</code> <para>Get the sharing processes for kernel32.dll.</para> </example> <example> <code>Get-NtFileShareProcess -Path "C:\windows\system32\kernel32.dll" -Win32Path</code> <para>Get the sharing processes for kernel32.dll.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileShareProcessCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileStreamCmdlet"> <summary> <para type="synopsis">Get named streams for a file.</para> <para type="description">This cmdlet gets a list of the named streams for a file.</para> </summary> <example> <code>Get-NtFileStream -File $f</code> <para>Get the streams for the file.</para> </example> <example> <code>Get-NtFileStream -Path "\??\c:\windows\notepad.exe"</code> <para>Get the streams for the file by path.</para> </example> <example> <code>Get-NtFileStream -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Get the streams for the file by win32 path.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileStreamCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet"> <summary> <para type="synopsis">Call QueryVolume on a file.</para> <para type="description">This cmdlet queries volume information from an file handle. </para> </summary> <example> <code>Get-NtFileVolumeInformation -File $file -InformationClass FileFsVolumeInformation</code> <para>Query the info class for the object.</para> </example> <example> <code>Get-NtFileVolumeInformation -Object $obj -InformationClass FileFsVolumeInformation -InitBuffer @(1, 2, 3, 4)</code> <para>Query the info class providing an initial buffer as bytes.</para> </example> <example> <code>Get-NtFileVolumeInformation -Object $obj -InformationClass FileFsVolumeInformation -Length 16</code> <para>Query the info class providing an initial 16 byte buffer.</para> </example> <example> <code>Get-NtFileVolumeInformation -Object $obj -InformationClass FileFsVolumeInformation -AsBuffer</code> <para>Query the info class and return a safe buffer.</para> </example> /// <example> <code>Get-NtFileVolumeInformation -Object $obj -InformationClass FileFsVolumeInformation -AsType $type</code> <para>Query the info class and a typed value. $type needs to be a blitable .NET type.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.File"> <summary> <para type="description">Specify the file to query information from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.InformationClass"> <summary> <para type="description">Specify the information class to query.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.AsBuffer"> <summary> <para type="description">Return the result as a buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.AsType"> <summary> <para type="description">Return the result as a type rather than a byte array. Also uses type size for initial sizing.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.InitBuffer"> <summary> <para type="description">Specify initial value as a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.Length"> <summary> <para type="description">Specify initial value as an empty buffer of a specified length.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileVolumeInformationCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet"> <summary> <para type="synopsis">Gets the granted access to a security descriptor or object.</para> <para type="description">This cmdlet allows you to determine the granted access to a particular resource through a security descriptor or a reference to an object.</para> </summary> <example> <code>Get-NtGrantedAccess $sd -Type $(Get-NtType File)</code> <para>Get the maximum access for a security descriptor for a file object.</para> </example> <example> <code>Get-NtGrantedAccess -Sddl "O:BAG:BAD:(A;;GA;;;WD)" -Type $(Get-NtType Process)</code> <para>Get the maximum access for a security descriptor for a process object based on an SDDL string.</para> </example> <example> <code>Get-NtGrantedAccess -Object $obj</code> <para>Get the maximum access for a security descriptor for an object.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.SecurityDescriptor"> <summary> <para type="description">Specify a security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.Sddl"> <summary> <para type="description">Specify a security descriptor in SDDL format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.Type"> <summary> <para type="description">Specify the NT type for the access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.Object"> <summary> <para type="description">Specify an object to get security descriptor from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.Container"> <summary> <para type="description">Specify if the type is a container..</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.GetSecurityDescriptor"> <summary> Abstract method to get the security descriptor for access checking. </summary> <returns>The security descriptor.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtGrantedAccessCmdlet.GetNtType"> <summary> Abstract method to get the NT type for the access check. </summary> <returns>The NT type.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtJobCmdlet"> <summary> <para type="synopsis">Open a NT job object by path.</para> <para type="description">This cmdlet opens an existing NT job object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtJob \BaseNamedObjects\ABC</code> <para>Get an job object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtJob ABC -Root $root</code> <para>Get an job object with a relative path.</para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtJob ABC</code> <para>Get a job object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtJobCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtJobCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtJobCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtKeyChildCmdlet"> <summary> <para type="synopsis">Get the accessible children of a key.</para> <para type="description">This cmdlet gets the children of a key object. It allows the children to be extracted recursively. You can choose to get the children through the pipeline or specify a vistor script. </para> </summary> <example> <code>$keys = Get-NtKeyChild $key</code> <para>Get immediate children of a key.</para> </example> <example> <code>$keys = Get-NtKeyChild $key -Recurse</code> <para>Get children of a key recursively.</para> </example> <example> <code>$keys = Get-NtKeyChild $key -Recurse -OpenForBackup</code> <para>Get children of a key recursively.</para> </example> <example> <code>$keys = Get-NtKeyChild $key -Recurse -MaxDepth 2</code> <para>Get children of a key recursively up to a maximum depth of 2.</para> </example> <example> <code>$keys = Get-NtKeyChild $key Access ReadControl</code> <para>Get children of a key which can be opened for ReadControl access.</para> </example> <example> <code>Get-NtKeyChild $key -Visitor { $path = $_.FullPath; Write-Host $path }</code> <para>Get children of a key via the visitor pattern.</para> </example> <example> <code>Get-NtKeyChild $key -Recurse -Visitor { $path = $_.FullPath; Write-Host $path; $path -notmatch "BLAH" }</code> <para>Get children of a key via the visitor pattern, exiting the recursion if the object path contains the string BLAH.</para> </example> <example> <code>$keys = Get-NtKeyChild $key -Recurse -Filter { $_.FullPath -match "BLAH" }</code> <para>Get children of a key filtering out any objects which don't have BLAH in the name.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeyChildCmdlet.BeginProcessing"> <summary> Overridden BeginProcessing. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtKeyChildCmdlet.OpenForBackup"> <summary> <para type="description">Open keys for backup. Needs SeBackupPrivilege enabled.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeyChildCmdlet.VisitChildObjects(System.Func{NtApiDotNet.NtKey,System.Boolean})"> <summary> Overridden visit method. </summary> <param name="visitor">The visitor function.</param> <returns>Returns true if visited all children.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet"> <summary> <para type="synopsis">Open a NT key object by path.</para> <para type="description">This cmdlet opens an existing NT key object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtKey \Registry\Machine\Software</code> <para>Get a key object with an absolute path.</para> </example> <example> <code>$root = Get-NtKey \Registry\Machine
$obj = Get-NtKey Software -Root $root</code> <para>Get a key object with a relative path. </para> </example> <example> <code>$obj = Get-NtKey \Registry\Machine\Software
$obj.QueryKeys()</code> <para>Get a key object, and enumerate its subkeys</para> </example> <example> <code>$obj = Get-NtKey \Registry\Machine\Software
$obj.QueryValues()</code> <para>Get a key object, and enumerate its values</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.Options"> <summary> <para type="description">Options to use when opening/creating the key.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.Transaction"> <summary> <para type="description">Specify a transaction to create the key under.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.ResolvePath"> <summary> Virtual method to resolve the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeyCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtKeySymbolicLinkTarget"> <summary> <para type="synopsis">Open and reads the symbolic link target for a key.</para> <para type="description">This cmdlet opens a existing NT keys object and reads out the symbolic link target. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>Get-NtKeySymbolicLinkTarget -Path \Registry\Machine\SYSTEM\CurrentControlSet</code> <para>Reads the CurrentControlSet symbolic link target.</para> </example> <example> <code>Get-NtKeySymbolicLinkTarget -Win32Path HKLM\SYSTEM\CurrentControlSet</code> <para>Reads the CurrentControlSet symbolic link target with a Win32 path.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtKeySymbolicLinkTarget.FormatWin32Path"> <summary> <para type="description">Specify to pass through the created key.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeySymbolicLinkTarget.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtKeySymbolicLinkTarget.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtMutantCmdlet"> <summary> <para type="synopsis">Open a NT mutant object by path.</para> <para type="description">This cmdlet opens an existing NT mutant object (also known as a mutex). The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtMutant \BaseNamedObjects\ABC</code> <para>Get a mutant object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtMutant ABC -Root $root</code> <para>Get a mutant object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtMutant ABC</code> <para>Get a mutant object with a relative path based on the current location. </para> </example> <example> <code>$obj = Get-NtMutant -Path \BaseNamedObjects\ABC
$obj.Wait()
# Do something in lock...
$obj.Release()</code> <para>Get a mutant object, acquire the lock via Wait and Release it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtMutantCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtMutantCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtMutantCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtNamedPipeFileCmdlet"> <summary> <para type="synopsis">Opens an existing NT named pipe file object.</para> <para type="description">This cmdlet opens an existing NT named pipe file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. This only works if the caller has permission to access the pipe server object and the maximum number of instances is not exceeded.</para> </summary> <example> <code>$obj = Get-NtNamedPipeFile \??\pipe\abc</code> <para>Opens an existing file named pipe object with an absolute path.</para> </example> <example> <code>$obj = Get-NtNamedPipeFile \\.\pipe\abc -Win32Path</code> <para>Opens an existing file named pipe object with an absolute win32 path.</para> </example> <example> <code>$obj = Get-NtNamedPipeFile \??\pipe\abc -Disposition OpenIf</code> <para>Opens an existing file named pipe object with an absolute path. If the file already exists then open it rather than failing.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtNamedPipeFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtNamedPipeFileCmdlet.#ctor"> <summary> Constructor </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet"> <summary> <para type="synopsis">Open an NT object by path.</para> <para type="description">This cmdlet opens an NT object by its path. The returned object will be a type specific to the actual underlying NT type. </para> </summary> <example> <code>$obj = Get-NtObject \BaseNamedObjects\ABC</code> <para>Get a existing object with an absolute path.</para> </example> <example> <code>$obj = Get-NtObject \BaseNamedObjects -TypeName Directory</code> <para>Get a existing object with an explicit type.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtObject ABC -Root $root</code> <para>Get an existing object with a relative path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet.TypeName"> <summary> <para type="description">The type of object will try and be determined automatically, however in cases where this isn't possible the NT type name can be specified here. This needs to be a value such as Directory, SymbolicLink, Mutant etc. </para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet.GetBasePath"> <summary> Get the base object manager path for the current powershell directory. </summary> <returns>The base path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtObjectCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet"> <summary> <para type="synopsis">Call QueryInformation on the object type.</para> <para type="description">This cmdlet queries information from an object handle. You specify the information class by name or number. </para> </summary> <example> <code>Get-NtObjectInformation -Object $obj -InformationClass BasicInfo</code> <para>Query the basic info class for the object.</para> </example> <example> <code>Get-NtObjectInformation -Object $obj -InformationClass 1</code> <para>Query the info class 1 for the object.</para> </example> <example> <code>Get-NtObjectInformation -Object $obj -InformationClass BasicInfo -InitBuffer @(1, 2, 3, 4)</code> <para>Query the basic info class providing an initial buffer as bytes.</para> </example> <example> <code>Get-NtObjectInformation -Object $obj -InformationClass BasicInfo -Length 16</code> <para>Query the basic info class providing an initial 16 byte buffer.</para> </example> <example> <code>Get-NtObjectInformation -Object $obj -InformationClass BasicInfo -AsBuffer</code> <para>Query the basic info class and return a safe buffer.</para> </example> /// <example> <code>Get-NtObjectInformation -Object $obj -InformationClass BasicInfo -AsType $type</code> <para>Query the basic info class and a typed value. $type needs to be a blitable .NET type.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.Object"> <summary> <para type="description">Specify the object to query information from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.InformationClass"> <summary> <para type="description">Specify the information class to query. Can be a string or an integer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.AsBuffer"> <summary> <para type="description">Return the result as a buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.AsType"> <summary> <para type="description">Return the result as a type rather than a byte array. Also uses type size for initial sizing.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.AsObject"> <summary> <para type="description">Return the result as a type rather than a byte array. Also uses type size for initial sizing.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.InitBuffer"> <summary> <para type="description">Specify initial value as a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.Length"> <summary> <para type="description">Specify initial value as an empty buffer of a specified length.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtObjectInfoCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtPartitionCmdlet"> <summary> <para type="synopsis">Open a NT partition object.</para> <para type="description">This cmdlet opens an existing NT partition object.</para> </summary> <example> <code>$obj = Get-NtPartition \BaseNamedObjects\ABC</code> <para>Get a partition object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtPartition ABC -Root $root</code> <para>Get a partition object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtPartition ABC</code> <para>Get a partition object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtPartitionCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtPartitionCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtPartitionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtProcessJobCmdlet"> <summary> <para type="synopsis">Gets the accessible Job objects assigned to a process.</para> <para type="description">This cmdlet gets the accessible Job objects for a process. This might not include all Jobs and might contain duplicates.</para> </summary> <example> <code>Get-NtProcessJob -Process $process</code> <para>Gets the Job objects assigned to the process.</para> </example> <example> <code>Get-NtProcessJob -Process $process -Silo</code> <para>Gets the silo Job objects assigned to the process.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessJobCmdlet.Process"> <summary> <para type="description">Specify the process to query.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessJobCmdlet.Silo"> <summary> <para type="description">Specify to only return Silo objects.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtProcessJobCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtResourceManagerCmdlet"> <summary> <para type="synopsis">Open a NT Resource Manager object or all from a Transaction Manager..</para> <para type="description">This cmdlet opens an existing NT Resource Manager object.</para> </summary> <example> <code>$obj = Get-NtTransaction -TransactionManager $tm</code> <para>Get all Resource Manager objects from a Transaction Manager.</para> </example> <example> <code>$obj = Get-NtTransaction -ResourceManagerGuid '04422e91-63c2-4025-944d-d66fae133274' -TransactionManager $tm</code> <para>Get a Resource Manager object from its GUID and Transaction Manager.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtResourceManagerCmdlet.ResourceManagerGuid"> <summary> <para type="description">Specify the Resource Manager GUID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtResourceManagerCmdlet.TransactionManager"> <summary> <para type="description">Specify the Transaction Manager containing the Resource Manager.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtResourceManagerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtSectionCmdlet"> <summary> <para type="synopsis">Open a NT section object by path.</para> <para type="description">This cmdlet opens an existing NT section object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtSection \BaseNamedObjects\ABC</code> <para>Get a section object with an absolute path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSectionCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSectionCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSectionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtSemaphoreCmdlet"> <summary> <para type="synopsis">Open a NT semaphore object by path.</para> <para type="description">This cmdlet opens an existing NT semaphore object (also known as a mutex). The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtSemaphore \BaseNamedObjects\ABC</code> <para>Get a semaphore object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtSemaphore ABC -Root $root</code> <para>Get a semaphore object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtSemaphore ABC</code> <para>Get a semaphore object with a relative path based on the current location. </para> </example> <example> <code>$obj = Get-NtSemaphore -Path \BaseNamedObjects\ABC
$obj.Wait()
# Do something in lock...
$obj.Release()</code> <para>Get a semaphore object, acquire the lock via Wait and Release it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSemaphoreCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSemaphoreCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSemaphoreCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet"> <summary> <para type="synopsis">Get a SID using various different mechanisms.</para> <para type="description">This cmdlet will create a SID object based on one of many mechanisms. For example it can parse the SDDL representation of the SID, or it can look up the account name. It can also create a SID based on a service name or integrity level. </para> </summary> <example> <code>Get-NtSid BA</code> <para>Gets the Sid for the builtin administrators group based on the SDDL form.</para> </example> <example> <code>Get-NtSid S-1-2-3-4-5</code> <para>Gets the Sid S-1-2-3-4-5 from its SDDL form.</para> </example> <example> <code>Get-NtSid -Name domain\user</code> <para>Gets the Sid for the username 'user' in domain 'domain'.</para> </example> <example> <code>Get-NtSid -Name BUILTIN\Administrators</code> <para>Gets the Sid for the the builtin administrators group.</para> </example> <example> <code>Get-NtSid -ServiceName service</code> <para>Gets the Sid for service name 'service'.</para> </example> <example> <code>Get-NtSid -IntegrityLevel Low</code> <para>Gets the Sid Low integrity level.</para> </example> <example> <code>Get-NtSid -IntegrityLevelRaw 1234</code> <para>Gets the Sid for the arbitrary integrity level 1234.</para> </example> <example> <code>Get-NtSid -PackageName some.package.name</code> <para>Gets the Sid for App Container package name 'some.package.name'.</para> </example> <example> <code>Get-NtSid -PackageName some.package.name -RestrictedPackageName restricted</code> <para>Gets the Sid for App Container package name 'some.package.name' with the restricted name 'restricted'</para> </example> <example> <code>Get-NtSid -KnownSid BuiltinAdministrators</code> <para>Gets the Sid for the builtin administrators group.</para> </example> <example> <code>Get-NtSid -Token</code> <para>Gets the Sid for the current user.</para> </example> <example> <code>Get-NtSid -LogonGroup</code> <para>Gets the Sid for the current default logon group.</para> </example> <example> <code>Get-NtSid -CapabilityName internetClient</code> <para>Gets the capability Sid the internetClient capability.</para> </example> <example> <code>Get-NtSid -CapabilityName internetClient -CapabilityGroup</code> <para>Gets the capability group Sid the internetClient capability.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Sddl"> <summary> <para type="description">Specify a SID using an SDDL string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.AccessControlEntry"> <summary> <para type="description">Specify a SID from an ACE.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Name"> <summary> <para type="description">Lookup a SID using an NT account name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.ServiceName"> <summary> <para type="description">Create a SID based on a service name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.IntegrityLevel"> <summary> <para type="description">Create a SID based on the standard set of integrity levels.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.IntegrityLevelRaw"> <summary> <para type="description">Create a SID based on a raw integerity level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.PackageName"> <summary> <para type="description">Create a SID from App Container package name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.RestrictedPackageName"> <summary> <para type="description">Specify an additional restricted name for the package SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.AsCapability"> <summary> <para type="description">Specify the package SID should be in capability format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.KnownSid"> <summary> <para type="description">Get a known SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Token"> <summary> <para type="description">Get the SID from the current user token. Defaults to the user SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Owner"> <summary> <para type="description">Get the SID for the current default owner.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.PrimaryGroup"> <summary> <para type="description">Get the SID for the current default group.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.LogonGroup"> <summary> <para type="description">Get the SID for the current login group.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.AppContainer"> <summary> <para type="description">Get the SID for the current package (if an App Container token).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Label"> <summary> <para type="description">Get the SID for the current integrity level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.CapabilityName"> <summary> <para type="description">Create a SID from App Container capability name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.CapabilityGroup"> <summary> <para type="description">Returns the group capability SID rather than normal capability SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.SecurityAuthority"> <summary> <para type="description">Specify a SIDs security authority.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.SecurityAuthorityByte"> <summary> <para type="description">Specify a SIDs security authority.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.RelativeIdentifier"> <summary> <para type="description">Specify the relative identifiers.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.BaseSid"> <summary> <para type="description">Specify the base SID to create a relative SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Sibling"> <summary> <para type="description">Specify you create a sibling SID rather than a child relative SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.NewLogon"> <summary> <para type="description">Get a new logon session SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.TrustType"> <summary> <para type="description">Specify protected type for Trust SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.TrustLevel"> <summary> <para type="description">Specify level for Trust SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.AsSddl"> <summary> <para type="description">Output the SID in SDDL format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.AsName"> <summary> <para type="description">Output the name of the SID from LSASS.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.Byte"> <summary> <para type="description">Specify a SIDs as a byte array.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSidCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtStatusResult"> <summary> The result of an NTSTATUS code lookup. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Status"> <summary> The numeric value of the status code. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.StatusSigned"> <summary> The numeric value of the status code as a signed integer. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.StatusName"> <summary> The name of the status code if known. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Message"> <summary> Corresponding message text. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Win32Error"> <summary> Win32 error code. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Win32ErrorCode"> <summary> Win32 error as an integer. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Code"> <summary> The status code. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.CustomerCode"> <summary> True if a customer code. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Reserved"> <summary> True if reserved. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Facility"> <summary> The status facility. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtStatusResult.Severity"> <summary> The status severity. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtStatusCmdlet"> <summary> <para type="synopsis">Get known information about an NTSTATUS code.</para> <para type="description">This cmdlet looks up an NTSTATUS code and if possible prints the enumeration name, the message description and the corresponding win32 error. </para> </summary> <example> <code>Get-NtStatus</code> <para>Gets all known NTSTATUS codes defined in this library.</para> </example> <example> <code>Get-NtStatus -Status 0xC0000022</code> <para>Gets information about a specific status code.</para> </example> <example> <code>Get-NtStatus -Name "STATUS_ACCESS_DENIED"</code> <para>Gets information about a specific status code.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtStatusCmdlet.Status"> <summary> <para type="description">Specify a NTSTATUS code to retrieve.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtStatusCmdlet.Name"> <summary> <para type="description">Specify the name of a Status Code to retrieve.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtStatusCmdlet.PassStatus"> <summary> <para type="description">Pass the NtStatus enumeration rather than the status information.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtStatusCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkCmdlet"> <summary> <para type="synopsis">Open a existing NT symbolic link object.</para> <para type="description">This cmdlet opens a existing NT symbolic link object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtSymbolicLink \DosDevices\ABC</code> <para>Open a symbolic link object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \DosDevices
$obj = Get-NtSymbolicLink ABC -Root $root</code> <para>Open a symbolic link object with a relative path.</para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtSymbolicLink ABC</code> <para>Get a symbolic link object with a relative path based on the current location.</para> </example> <example> <code>$obj = Get-NtSymbolicLink \DosDevices\ABC
$obj.Query()</code> <para>Open a symbolic link object and query its target.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkTargetCmdlet"> <summary> <para type="synopsis">Get the target path for an existing NT symbolic link object.</para> <para type="description">This cmdlet opens a existing NT symbolic link object and queries its target path. That can be done using Get-NtSymbolicLink and the Query method but this simplifies the operation so that the object handle doesn't have to be closed.</para> </summary> <example> <code>Get-NtSymbolicLinkTarget \DosDevices\ABC</code> <para>Gets the symbolic link object target with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \DosDevices
Get-NtSymbolicLinkTarget ABC -Root $root</code> <para>Gets the symbolic link object target with a relative path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkTargetCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkTargetCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkTargetCmdlet.Resolve"> <summary> <para type="description">Resolve the final target. This will follow the target if it's still a symbolic link.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtSymbolicLinkTargetCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.ServiceAccountType"> <summary> <para type="description">Type of service account to create.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.ServiceAccountType.System"> <summary> Create SYSTEM token. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.ServiceAccountType.LocalService"> <summary> Create Local Service token. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.ServiceAccountType.NetworkService"> <summary> Create Network Service token. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.ServiceAccountType.IUsr"> <summary> Create IUsr Service token. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet"> <summary> <para type="synopsis">Open an NT token from different sources.</para> <para type="description">This cmdlet gets a token from one of multiple possible sources. You can specify either a Primary process token, a Thread impersonation token, an Effective token, a Clipboard token, a Logon/S4U token, the anonymous token, a lowbox or a filtered token.</para> <para>Note that tokens objects need to be disposed of after use, therefore capture them in Use-NtObject or manually Close them once used.</para> </summary> <example> <code>$obj = Get-NtToken</code> <para>Get current process' primary token.</para> </example> <example> <code>$obj = Get-NtToken -Pseudo</code> <para>Get current process' pseudo primary token.</para> </example> <example> <code>$obj = Get-NtToken -Primary</code> <para>Get current process' primary token (-Primary is optional)</para> </example> <example> <code>$obj = Get-NtToken -Access Duplicate</code> <para>Get current process' primary token for Duplicate access.</para> </example> <example> <code>$obj = Get-NtToken -Duplicate -TokenType Impersonation -ImpersonationLevel Impersonation</code> <para>Get current process' primary token and convert to an impersonation token.</para> </example> <example> <code>$obj = Get-NtToken -Duplicate -TokenType Primary -IntegrityLevel Low</code> <para>Get current process token, duplicate as primary and set integrity level to Low.</para> </example> <example> <code>$obj = Get-NtTokenPrimary -Access AdjustPrivileges
$obj.SetPrivilege("SeDebugPrivilege", $true)</code> <para>Enable debug privilege on current token.</para> </example> <example> <code>$process = Get-NtProcess -ProcessId 1234
$obj = Get-NtToken -Primary -Process $process</code> <para>Get process token for a specific process.</para> </example> <example> <code>$obj = Get-NtToken -Primary -ProcessId 1234</code> <para>Get process token for a specific process by process ID.</para> </example> <example> <code>$obj = Get-NtToken -Primary
$obj.GetPrivileges()</code> <para>Query the privileges of a token.</para> </example> <example> <code>$obj = Get-NtToken -Primary
$obj.GetGroups()</code> <para>Query the groups of a token.</para> </example> <example> <code>$thread = Get-NtThread -ThreadId 1234
$obj = Get-NtToken -Impersonation -Thread $thread</code> <para>Get the impersonation token for a specific thread.</para> </example> <example> <code>$obj = Get-NtToken -Impersonation -ThreadId 1234</code> <para>Get impersonation token for a specific thread by ID.</para> </example> <example> <code>$obj = Get-NtToken -Effective -ThreadId 1234</code> <para>Get the effective token for a specific thread by ID.</para> </example> <example> <code>$obj = Get-NtToken -Clipboard</code> <para>Get the current clipboard token.</para> </example> <example> <code>$obj = Get-NtToken -Logon -User Bob -Password BobP@ssword</code> <para>Get network logon token for user Bob in the current domain with password BobP@ssword.</para> </example> <example> <code>$obj = Get-NtToken -Logon -User Bob -Password BobP@ssword -Domain BADGERS -LogonType Interactive</code> <para>Get interactive logon token for BADGERS\\Bob with password BobP@ssword.</para> </example> <example> <code>$obj = Get-NtToken -S4U -User Bob -Domain BADGERS</code> <para>Get S4U network logon token for BADGERS\\Bob with no password.</para> </example> <example> <code>$obj = Get-NtToken -Anonymous</code> <para>Get the anonymous logon token.</para> </example> <example> <code>Get-NtToken -Filtered -Flags DisableMaxPrivileges</code> <para>Get current process' primary token and disable the maximum privileges.</para> </example> <example> <code>Get-NtToken -Filtered -SidsToDisable "WD","BA"</code> <para>Get current process' primary token and set Everyone and Built Administrators groups to deny only.</para> </example> <example> <code>$token = Use-NtObject($tmp = Get-NtToken -Primary) { Get-NtToken -Filtered -Token $tmp -RestrictedSids $tmp.Groups }</code> <para>Get current process' primary token, pass it as an explicit token and add all groups as restricted SIDs.</para> </example> <example> <code>Get-NtToken -Filtered -Flags LuaToken</code> <para>Get current process' primary token and convert it to a LUA token.</para> </example> <example> <code>Get-NtToken -LowBox -PackageSid "Application.Name"</code> <para>Get current process' primary token create a lowbox token with a named package.</para> </example> <example> <code>Get-NtToken -LowBox -PackageSid "S-1-15-2-1-2-3-4-5-6-7"</code> <para>Get current process' primary token create a lowbox token with a package Sid.</para> </example> <example> <code>Get-NtToken -LowBox -PackageSid "Application.Name" -CapabilitySid "readRegistry", "S-1-15-3-1"</code> <para>Get current process' primary token create a lowbox token with a named package and the internetClient and readRegistry capabilities.</para> </example> <example> <code>Get-NtToken -Session</code> <para>Get current session token.</para> </example> <example> <code>Get-NtToken -Session -SessionId 10</code> <para>Get session token for session 10.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Access"> <summary> <para type="description">Specify access rights for the token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Duplicate"> <summary> <para type="description">Return a duplicated version of the token. The type of token is specified using -TokenType and -ImpersonationLevel</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.TokenType"> <summary> <para type="description">Specify the type of token to create if -Duplicate is specified.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.ImpersonationLevel"> <summary> <para type="description">Specify the impersonation level of the token to create if -Duplicate is specified and TokenType is Impersonation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.IntegrityLevel"> <summary> <para type="description">Specify the integrity level of the token to if -Duplicate is specified.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Primary"> <summary> <para type="description">Get the primary token for a process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Process"> <summary> <para type="description">Specify the process to open the token from. If not set will use the current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.ProcessId"> <summary> <para type="description">Specify the process to open the token from as a PID. Overridden by the Process parameter.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Impersonation"> <summary> <para type="description">Get an impersonation token for a thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Effective"> <summary> <para type="description">If thread impersonation token doesn't exist then get the primary token for the associated process. This is getting the "effective" token for the thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Thread"> <summary> <para type="description">Specify the thread to open the token from. If not set will use the current thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.ThreadId"> <summary> <para type="description">Specify the thread to open the token from by ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.OpenAsSelf"> <summary> <para type="description">Specify the token should be open with the process identity rather than the impersonated identity.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Pseudo"> <summary> <para type="description">Specify the token should be a pseudo token. When set you can't use the object for anything other than queries.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Clipboard"> <summary> <para type="description">Get the current clipboard token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Logon"> <summary> <para type="description">Get a logon token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.LogonProvider"> <summary> <para type="description">Specify logon provider.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.WithTcb"> <summary> <para type="description">Specify to use SeTcbPrivilege for the logon. This might require finding a token to steal.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.S4U"> <summary> <para type="description">Get an Services for User (S4U) logon token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.User"> <summary> <para type="description">Specify username for logon token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Password"> <summary> <para type="description">Specify password for logon token. Can be a string or a secure string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.AdditionalGroup"> <summary> <para type="description">Specify additional group sids for logon token. Needs TCB privilege.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Domain"> <summary> <para type="description">Specify domain for logon token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.LogonType"> <summary> <para type="description">Specify logon type for logon token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Ticket"> <summary> <para type="description">Specify Service Ticket for Logon.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.KerbCred"> <summary> <para type="description">Specify optional TGT for logon.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Anonymous"> <summary> <para type="description">Get anonymous token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.LowBox"> <summary> <para type="description">Get a lowbox token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Filtered"> <summary> <para type="description">Get a filtered token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.AppContainer"> <summary> <para type="description">Get a AppContainer token. This creates all the necessary directories for the AppContainer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Token"> <summary> <para type="description">Specify the token to sandbox or query. If not specified then the current primary token is used.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.PrivilegesToDelete"> <summary> <para type="description">Specify list of privileges to delete.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.SidsToDisable"> <summary> <para type="description">Specify list group SIDS to disable.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.RestrictedSids"> <summary> <para type="description">Specify list restricted SIDS to add to token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Flags"> <summary> <para type="description">Specify filter flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.PackageSid"> <summary> <para type="description">Specify package SID or a package name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.RestrictedPackageName"> <summary> <para type="description">Specify an additional restricted name for the package SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.CapabilitySid"> <summary> <para type="description">Specify list of capability SIDS to add to token. Can specify an SDDL format string or a capability name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Handle"> <summary> <para type="description">Specify list of handles to capture with lowbox token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Service"> <summary> <para type="description">Specify a service account to create.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Session"> <summary> <para type="description">Specify getting a session token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.SessionId"> <summary> <para type="description">Specify the session ID for the session token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.Linked"> <summary> <para type="description">Specify to get the linked token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.ServiceName"> <summary> <para type="description">Specify to get the linked token.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTokenCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTokenDefaultDacl"> <summary> <para type="synopsis">Get the Default DACL from a Token.</para> <para type="description">This cmdlet gets the Default DACL from a Token.</para> </summary> <example> <code>$dacl = Get-NtTokenDefaultDacl</code> <para>Get current effective token's Default DACL.</para> </example> <example> <code>$dacl = Get-NtTokenDefaultDacl -Token $token</code> <para>Get Default DACL from a Token.</para> </example> <example> <code>$sd = Get-NtTokenDefaultDacl -AsSecurityDescriptor</code> <para>Get current process' primary token's Default DACL as a Security Descriptor.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenDefaultDacl.Token"> <summary> <para type="description">Specify the token to query for the default DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTokenDefaultDacl.AsSecurityDescriptor"> <summary> <para type="description">Specify to return the ACL in a Security Descriptor.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTokenDefaultDacl.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTransactionCmdlet"> <summary> <para type="synopsis">Open a NT transaction object or get all accessible transaction objects.</para> <para type="description">This cmdlet opens an existing NT transaction object or can get all accessible transaction objects.</para> </summary> <example> <code>$obj = Get-NtTransaction</code> <para>Get all accessible transaction objects.</para> </example> <example> <code>$obj = Get-NtTransaction -TransactionManager $tm</code> <para>Get all accessible transaction objects in a specific transaction manager.</para> </example> <example> <code>$obj = Get-NtTransaction -UnitOfWork '04422e91-63c2-4025-944d-d66fae133274'</code> <para>Get a transaction object from its Unit of Work GUID.</para> </example> <example> <code>$obj = Get-NtTransaction -UnitOfWork '04422e91-63c2-4025-944d-d66fae133274' -TransactionManager $tm</code> <para>Get a transaction object from its Unit of Work GUID from a specific transaction manager.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionCmdlet.UnitOfWork"> <summary> <para type="description">Specify the Unit of Work GUID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionCmdlet.TransactionManager"> <summary> <para type="description">Specify an optional Transaction Manager.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTransactionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet"> <summary> <para type="synopsis">Open a NT transaction manager object or all transaction manager objects.</para> <para type="description">This cmdlet opens an existing NT transaction manager object or all transaction manager objects.</para> </summary> <example> <code>$obj = Get-NtTransactionManager</code> <para>Get all accessible transaction manager objects.</para> </example> <example> <code>$obj = Get-NtTransactionManager \BaseNamedObjects\ABC</code> <para>Get a transaction manager object with an absolute path.</para> </example> <example> <code>$obj = Get-NtTransactionManager -Identity '04422e91-63c2-4025-944d-d66fae133274'</code> <para>Get a transaction manager object from its identity GUID.</para> </example> <example> <code>$obj = Get-NtTransactionManager \??\c:\abc\xyz</code> <para>Get a transaction manager object from an existing logfile.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = Get-NtTransactionManager ABC -Root $root</code> <para>Get a transaction manager object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = Get-NtTransactionManager ABC</code> <para>Get a transaction manager object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.Identity"> <summary> <para type="description">Specify a identity GUID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.OpenFlags"> <summary> <para type="description">Specify optional open flags..</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.LogFile"> <summary> <para type="description">Specify that the path resolves to a logfile rather than an object manager path.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.ResolvePath"> <summary> Virtual method to resolve the value of the Path variable. </summary> <returns>The object path, returns null if resolving a log file.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTransactionManagerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet"> <summary> <para type="synopsis">Get a wait timeout which represents a specific time.</para> <para type="description">This cmdlet gets an NtWaitTimeout which can be passed to other calls. The timeout value is a combination of all the allowed time parameters, e.g. if you specify 1 second and 1000 milliseconds it will actually wait 2 seconds in total. Specifying -Infinite will get cause a wait to stop indefinitely.</para> </summary> <example> <code>$to = Get-NtWaitTimeout -Seconds 10</code> <para>Get a wait timeout represent 10 seconds.</para> </example> <example> <code>$to = Get-NtWaitTimeout Infinite</code> <para>Get a wait timeout representing infinity.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.Second"> <summary> <para type="description">Specify a wait time in seconds.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.MilliSecond"> <summary> <para type="description">Specify a wait time in milliseconds.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.Minute"> <summary> <para type="description">Specify a wait time in minutes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.Hour"> <summary> <para type="description">Specify a wait time in hours.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.Infinite"> <summary> <para type="description">Specify an infinite wait time.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.GetTimeout"> <summary> Get the NtWaitTimeout object. </summary> <returns>The NtWaitTime object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWaitTimeoutCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet"> <summary> <para type="synopsis">Invokes a script block while impersonating a token.</para> <para type="description">This cmdlet invokes a script block while impersonating a token. Optionally can impersonate the anonymous token directly.</para> </summary> <example> <code>Invoke-NtToken -Token $token -Script { Get-NtFile \Path\To\File }</code> <para>Open a file under impersonation.</para> </example> <example> <code>Invoke-NtToken -Token $token -ImpersonationLevel Identification -Script { Get-NtToken -Impersonation -OpenAsSelf }</code> <para>Open the impersontation token under identification level impersonation.</para> </example> <example> <code>Invoke-NtToken -Script { Get-NtProcess -ProcessId 1234 } -Anonymous</code> <para>Open a process while impersonating the anonymous token.</para> </example> <example> <code>Invoke-NtToken -Script { Get-NtProcess -ProcessId 1234 } -System</code> <para>Open a process while impersonating a system token. Needs administrator privileges.</para> </example> <example> <code>Invoke-NtToken -Script { Get-NtProcess -ProcessId 1234 } -Current -ImpersonationLevel Identification </code> <para>Open a process while impersonating a current token at identitification level.</para> </example> <example> <code>Invoke-NtToken -Script { Get-NtProcess -ProcessId 1234 } -Socket $socket</code> <para>Open a process while impersonating a secure socket.</para> </example> <example> <code>Invoke-NtToken -Script { Get-NtProcess -ProcessId 1234 } -Client $client</code> <para>Open a process while impersonating a secure TCP client.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Token"> <summary> <para type="description">Specify the token to impersonate.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Script"> <summary> <para type="description">The script block to execute during impersonation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Current"> <summary> <para type="description">Specify to impersonate the current Token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.System"> <summary> <para type="description">Specify to impersonate a system Token. Must be an administrator.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.ImpersonationLevel"> <summary> <para type="description">When the token is duplicated specify the impersonation level to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.IntegrityLevel"> <summary> <para type="description">When the token is duplicated specify an Integrity Level to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Anonymous"> <summary> <para type="description">Impersonate the anonymous token and run the script.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Socket"> <summary> <para type="description">Impersonate a secure socket.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.PeerAddress"> <summary> <para type="description">Peer address for socket impersonation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.Client"> <summary> <para type="description">Impersonate a secure TCP client.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.InputObject"> <summary> <para type="description">Specify an object to pass to the script.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.InvokeNtTokenCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.JobFormatFilter"> <summary> <para type="description">Flags for formatting a job.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.BasicInfo"> <summary> Basic information. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.BasicLimits"> <summary> Basic limits. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.ProcessList"> <summary> List of processes. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.UILimits"> <summary> UI Limits. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.Silo"> <summary> Silo information. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.JobFormatFilter.All"> <summary> Display all formats. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcDataViewCmdlet"> <summary> <para type="synopsis">Creates a new data view from a port section.</para> <para type="description">This cmdlet creates a new data view from a port section specified size and flags.</para> </summary> <example> <code>$s = New-NtAlpcDataView -Section $section -Size 10000</code> <para>Create a new data view with size 10000.</para> </example> <example> <code>$s = New-NtAlpcDataView -Size 10000 -Flags Secure</code> <para>Create a new secure data view section of size 10000.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcDataViewCmdlet.Section"> <summary> <para type="description">Specify the port to create the port section from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcDataViewCmdlet.Size"> <summary> <para type="description">Specify the size of the data view. This will be rounded up to the nearest allocation boundary.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcDataViewCmdlet.Flags"> <summary> <para type="description">Specify data view attribute flags.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcDataViewCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet"> <summary> <para type="synopsis">Creates a new ALPC message.</para> <para type="description">This cmdlet creates a new ALPC message based on a byte array or an length initializer. You can also specify a text encoding which allows you to use the DataString property.</para> </summary> <example> <code>$msg = New-NtAlpcMessage -Bytes @(0, 1, 2, 3)</code> <para>Create a new message from a byte array.</para> </example> <example> <code>$msg = New-NtAlpcMessage -Bytes @(0, 1, 2, 3) -AllocatedDataLength 1000</code> <para>Create a new message from a byte array with an allocated length of 1000 bytes.</para> </example> <example> <code>$msg = New-NtAlpcMessage -AllocatedDataLength 1000</code> <para>Create a new message with an allocated length of 1000 bytes.</para> </example> <example> <code>$msg = New-NtAlpcMessage -AllocatedDataLength 1000 -Encoding UTF8</code> <para>Create a new message with an allocated length of 1000 bytes and the message encoding is UTF8.</para> </example> <example> <code>$msg = New-NtAlpcMessage -String "Hello World!"</code> <para>Create a new message from a unicode string.</para> </example> <example> <code>$msg = New-NtAlpcMessage -String "Hello World!" -Encoding UTF8</code> <para>Create a new message from a UTF8 string.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.Bytes"> <summary> <para type="description">Create the message from a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.String"> <summary> <para type="description">Create the message from a string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.Encoding"> <summary> <para type="description">Get or set the text encoding for this message.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.AllocatedDataLength"> <summary> <para type="description">Specify the message with allocated length.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcMessageCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet"> <summary> <para type="synopsis">Creates a new ALPC port attributes structure.</para> <para type="description">This cmdlet creates a new ALPC port attributes structure based on single components.</para> </summary> <example> <code>$attr = New-NtAlpcPortAttributes</code> <para>Create a new ALPC port attributes structure with default values.</para> </example> <example> <code>$attr = New-NtAlpcPortAttributes -Flags None</code> <para>Create a new ALPC port attributes structure.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.Flags"> <summary> <para type="description">Port attributes flags</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.ImpersonationLevel"> <summary> <para type="description">Security Quality of Service impersonation level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.ContextTrackingMode"> <summary> <para type="description">Security Quality of Service context tracking mode.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.EffectiveOnly"> <summary> <para type="description">Security Quality of Service effective only.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MaxMessageLength"> <summary> <para type="description">Maximum message length.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MemoryBandwidth"> <summary> <para type="description">Memory bandwidth.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MaxPoolUsage"> <summary> <para type="description">Max pool usage.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MaxSectionSize"> <summary> <para type="description">Max section size.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MaxViewSize"> <summary> <para type="description">Max view size.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.MaxTotalSectionSize"> <summary> <para type="description">Max total section size.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.DupObjectTypes"> <summary> <para type="description">Duplicate object types..</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcPortAttributesCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet"> <summary> <para type="synopsis">Creates a new port section from a port.</para> <para type="description">This cmdlet creates a new port section with a specified size and flags for a port. You can then write to buffer and pass it as a view attribute.</para> </summary> <example> <code>$s = New-NtAlpcPortSection -Size 10000</code> <para>Create a new port section of size 10000.</para> </example> <example> <code>$s = New-NtAlpcPortSection -Size 10000 -Secure</code> <para>Create a new secure port section of size 10000.</para> </example> <example> <code>$s = New-NtAlpcPortSection -Section $sect</code> <para>>Create a new port section backed by an existing section.</para> </example> <example> <code>$s = New-NtAlpcPortSection -Section $sect -Size 10000</code> <para>>Create a new port section backed by an existing section with an explicit view size.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet.Port"> <summary> <para type="description">Specify the port to create the port section from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet.Size"> <summary> <para type="description">Specify the size of the port section. This will be rounded up to the nearest allocation boundary.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet.Secure"> <summary> <para type="description">Create a secure section.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet.Section"> <summary> <para type="description">Specify an existing section to back the port section.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcPortSectionCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcReceiveAttributesCmdlet"> <summary> <para type="synopsis">Creates a new receive attributes buffer.</para> <para type="description">This cmdlet creates a new receive attributes buffer for the specified set of attributes. This defaults to all known attributes.</para> </summary> <example> <code>$attrs = New-NtAlpcReceiveAttributes</code> <para>Create a new receive attributes buffer with space for all known attributes.</para> </example> <example> <code>$attrs = New-NtAlpcReceiveAttributes -Attributes View, Context</code> <para>Create a new receive attributes buffer with space for only View and Context attributes.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcReceiveAttributesCmdlet.Attributes"> <summary> <para type="description">Specify the list of attributes for the receive buffer.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcReceiveAttributesCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcReceiveAttributesCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet"> <summary> <para type="synopsis">Creates a new send attributes buffer.</para> <para type="description">This cmdlet creates a new send attributes buffer. The buffer can be initialized with a list of attributes or by specifying specific values.</para> </summary> <example> <code>$attrs = New-NtAlpcSendAttributes</code> <para>Create a new empty send attributes buffer.</para> </example> <example> <code>$attrs = New-NtAlpcSendAttributes -Attributes $view, $handle</code> <para>Create a new send attributes buffer with view and handle attribute objects.</para> </example> <example> <code>$attrs = New-NtAlpcSendAttributes -Object $proc</code> <para>Create a new send attributes buffer with a handle attribute from a process handle.</para> </example> <example> <code>$attrs = New-NtAlpcSendAttributes -WorkOnBehalfOf</code> <para>Create a new send attributes buffer with a Work on Behalf of attribute.</para> </example> <example> <code>$attrs = New-NtAlpcSendAttributes -DataView $dataview</code> <para>Create a new send attributes buffer with data view.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.Attributes"> <summary> <para type="description">Specify the list of attributes for the send buffer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.Object"> <summary> <para type="description">Create a handle attribute from a list of objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.Handle"> <summary> <para type="description">Create a handle attribute from a list of handle entries.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.WorkOnBehalfOf"> <summary> <para type="description">Add a Work on Behalf of attribute.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.DataView"> <summary> <para type="description">Add a data view attribute.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.SecurityQualityOfService"> <summary> <para type="description">Automatically create a security context attribute with a specified security quality of service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.SecurityContext"> <summary> <para type="description">Specify a security context attribute.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcSendAttributesCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcServerCmdlet"> <summary> <para type="synopsis">Creates a new ALPC server by path.</para> <para type="description">This cmdlet creates a new NT ALPC server. The absolute path to the object in the NT object manager name space must be specified. </para> </summary> <example> <code>$obj = New-NtAlpcServer "\RPC Control\ABC"</code> <para>Create a new ALPC server with an absolute path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcServerCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcServerCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcServerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcServerCmdlet.PortAttributes"> <summary> <para type="description">Optional port attributes.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet"> <summary> <para type="synopsis">Create a new NT debug object.</para> <para type="description">This cmdlet creates a new NT debug object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle. You can also attach a process to the new debug object immediately after creation.</para> </summary> <example> <code>$obj = New-NtDebug</code> <para>Create a new anonymous debug object.</para> </example> <example> <code>$obj = New-NtDebug \BaseNamedObjects\ABC</code> <para>Create a new debug object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtDebug ABC -Root $root</code> <para>Create a new debug object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtDebug ABC</code> <para>Create a new debug object with a relative path based on the current location. </para> </example> <example> <code>$obj = New-NtDebug -ProcessId 12345</code> <para>Create a new anonymous debug object and attach to PID 12345.</para> </example> <example> <code>$obj = New-NtDebug -Process $proc</code> <para>Create a new anonymous debug object and attach to a process object.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to attach to after creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet.Process"> <summary> <para type="description">Specify a process to attach to after creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet.Flags"> <summary> <para type="description">Specify flags for create.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDebugCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet"> <summary> <para type="synopsis">Creates a Desktop object by path.</para> <para type="description">This cmdlet creates a new Desktop object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = New-NtDesktop \Windows\WindowStations\WinSta0\ABC</code> <para>Create a Desktop object with an absolute path.</para> </example> <example> <code>$root = Get-NtNtWindowStation \Windows\WindowStations\WinSta0
$obj = New-NtDesktop ABC -Root $root</code> <para>Create a desktop object with a relative path. </para> </example> <example> <code>$obj = New-NtDesktop -Path ABC -Win32Path</code> <para>Create a desktop object from Win32 path in current Window Station.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.Device"> <summary> <para type="description">The device for the desktop.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.DeviceMode"> <summary> <para type="description">The device mode for the desktop.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.Flags"> <summary> <para type="description">The flags for the desktop.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.HeapSize"> <summary> <para type="description">The heap size for the desktop.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDesktopCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtDirectoryCmdlet"> <summary> <para type="synopsis">Create a new NT object directory by path.</para> <para type="description">This cmdlet creates a new NT object directory. It's possible to create a directory by its NT path, such as \Some\Path or it can also create a new private namespace which isn't represented by an accessible NT path but instead uses a boundary descriptor.</para> </summary> <example> <code>$obj = New-NtDirectory</code> <para>Create a new anonymous directory object.</para> </example> <example> <code>$obj = New-NtDirectory \BaseNamedObjects\ABC</code> <para>Create a new directory object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtDirectory ABC -Root $root</code> <para>Create a new directory object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtDirectory ABC</code> <para>Create a new directory object with a relative path based on the current location.</para> </example> <example> <code>$shadow = Get-NtDirectory \SomeDir
$obj = New-NtDirectory \BaseNamedObjects\ABC -ShadowDirectory $shadow</code> <para>Create a new directory object with a shadow directory. </para> </example> <example> <code>$obj = New-NtDirectory -PrivateNamespaceDescriptor WD:LW@ABC</code> <para>Create a new private namespace directory object with Everyone and Low Mandatory Level SIDs and name ABC.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> <para type="link">https://msdn.microsoft.com/en-us/library/windows/desktop/ms682419%28v=vs.85%29.aspx</para> <para type="link">https://msdn.microsoft.com/en-us/library/windows/desktop/ms682121(v=vs.85).aspx</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDirectoryCmdlet.ShadowDirectory"> <summary> <para type="description">Specifies another NT directory object to use as a shadown directory. This changes the lookup operation so that if an entry isn't in the created directory it will try and look it up in the shadown instead. </para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtDirectoryCmdlet.Flags"> <summary> <para type="description">Specifies flags to use when creating the directory object. </para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDirectoryCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtDirectoryCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet"> <summary> <para type="synopsis">Create a new NT file object.</para> <para type="description">This cmdlet creates a new NT file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\abc.txt</code> <para>Creates a new file object with an absolute path.</para> </example> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\ABC -Directory</code> <para>Creates a new directory file object with an absolute path.</para> </example> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\abc.txt -Attributes Hidden</code> <para>Creates a new file object with an absolute path, with the hidden attribute.</para> </example> <example> <code>$root = Get-NtFile \??\C:\Windows
$obj = New-NtFile Temp\abc.txt -Root $root</code> <para>Creates a new file object with a relative path.</para> </example> <example> <code>$obj = New-NtFile c:\Windows\Temp\abc.txt -Win32Path</code> <para>Creates a new file object with an absolute win32 path.</para> </example> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\abc.txt -Disposition OpenIf</code> <para>Creates a new file object with an absolute path. If the file already exists then open it rather than failing.</para> </example> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\abc.txt -Disposition Supersede</code> <para>Creates a new file object with an absolute path. If the file already exists then replace it with the new file.</para> </example> <example> <code>$obj = New-NtFile \??\C:\Windows\Temp\abc.txt -Options SynchronousIoNonAlert -Access GenericRead,GenericWrite,Synchronize
$stm = $obj.ToStream($true)
$stm.WriteByte(1)</code> <para>Creates a new file object with an absolute path then writes data to it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.FileAttribute"> <summary> <para type="description">Specify the file attributes for the new file.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.Disposition"> <summary> <para type="description">Specify the disposition for creating the file.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.EaBuffer"> <summary> <para type="description">Specify an EA buffer to pass to the create file call.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.Directory"> <summary> <para type="description">Specify to create a directory instead of a file.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.AllocationSize"> <summary> <para type="description">Specify initial allocation size.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtFileCmdlet.#ctor"> <summary> Constructor </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet"> <summary> <para type="synopsis">Create a new NT job object.</para> <para type="description">This cmdlet creates a new NT job object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtJob</code> <para>Create a new anonymous job object.</para> </example> <example> <code>$obj = New-NtJob \BaseNamedObjects\ABC</code> <para>Create a new job object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtJob ABC -Root $root</code> <para>Create a new job object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtJob ABC</code> <para>Create a new job object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.ActiveProcessLimit"> <summary> <para type="description">Specify a process limit for the job.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.LimitFlags"> <summary> <para type="description">Specify limit flags for the job.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.UiRestrictionFlags"> <summary> <para type="description">Specify UI Restriction flags for the job.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.CreateSilo"> <summary> <para type="description">Specify to create Job as a Silo.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.NoSiloRootDirectory"> <summary> <para type="description">Specify to not create a silo root directory.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.SiloRootDirectoryFlags"> <summary> <para type="description">Specify to flags when creating the Silo's root directory.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.CreateServerSilo"> <summary> <para type="description">Specify to create a server silo. Must be used with -CreateSilo.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.SystemRoot"> <summary> <para type="description">Specify system root for the server silo.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.DeleteEvent"> <summary> <para type="description">Specify event for when the silo is deleted.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.DownlevelContainer"> <summary> <para type="description">Specify whether silo is a downlevel container.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.ProcessMemoryLimit"> <summary> <para type="description">Specify to place a limit on process memory.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.JobMemoryLimit"> <summary> <para type="description">Specify to place a limit on job memory.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.ProcessTimeLimit"> <summary> <para type="description">Specify to place a limit on job user execution time.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.JobTimeLimit"> <summary> <para type="description">Specify to place a limit on job user execution time.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtJobCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtKeyCmdlet"> <summary> <para type="synopsis">Create a new NT key object.</para> <para type="description">This cmdlet creates a new NT key object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = New-NtKey \Registry\Machine\Software\ABC</code> <para>Create a new key object with an absolute path.</para> </example> <example> <code>$obj = New-NtKey -Path \Registry\Machine\Software\ABC
$obj.SetValue("ValueName", String, "DataValue")</code> <para>Create a new event object and set a string value.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtKeyCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtKeySymbolicLink"> <summary> <para type="synopsis">Create a new NT key symbolic link.</para> <para type="description">This cmdlet creates a new NT key symbolic link. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. Unlike New-NtKey this will only return the created Key if PassThru is specified.</para> </summary> <example> <code>New-NtKeySymbolicLink \Registry\Machine\Software\ABC -Target \Registry\Machine\Sofware\XYZ</code> <para>Create a new key symbolic link object with an absolute path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtKeySymbolicLink.Target"> <summary> <para type="description">Specify a target for the symbolic link.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtKeySymbolicLink.PassThru"> <summary> <para type="description">Specify to pass through the created key.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtKeySymbolicLink.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet"> <summary> <para type="synopsis">Create a new NT mailslot file object.</para> <para type="description">This cmdlet creates a new NT mailslot file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = New-NtMailslotFile \??\mailslot\abc</code> <para>Creates a new file mailslot object with an absolute path.</para> </example> <example> <code>$obj = New-NtMailslotFile \\.\mailslot\abc -Win32Path</code> <para>Creates a new file mailslot object with an absolute win32 path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet.DefaultTimeoutMs"> <summary> <para type="description">Specify the default timeout for the mailslot in MS (-1 for no timeout)</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet.MaximumMessageSize"> <summary> <para type="description">Specify the maximum message size (0 means any size)</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet.MailslotQuota"> <summary> <para type="description">Specify the mailslot quota.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtMailslotFileCmdlet.#ctor"> <summary> Constructor </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet"> <summary> <para type="synopsis">Create a new NT named pipe file object.</para> <para type="description">This cmdlet creates a new NT named pipe file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. The ShareMode is used to determine data direction, specify Write to make an inbound pipe (client->server), Read to make an outbound pipe (server->client) and Read, Write to make full duplex.</para> </summary> <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc</code> <para>Creates a new, full duplex file named pipe object with an absolute path.</para> </example> <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc -ShareMode Read</code> <para>Creates a new outbound file named pipe object with an absolute path.</para> </example> /// <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc -ShareMode Write</code> <para>Creates a new inbound file named pipe object with an absolute path.</para> </example> <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc -MaximumInstances 100</code> <para>Creates a new file named pipe object with an absolute path and with a maximum of 100 instances.</para> </example> <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc -UnlimitedInstances</code> <para>Creates a new file named pipe object with an absolute path and with a unlimited maximum number of instances.</para> </example> <example> <code>$obj = New-NtNamedPipeFile \\.\pipe\abc -Win32Path</code> <para>Creates a new file named pipe object with an absolute win32 path.</para> </example> <example> <code>$obj = New-NtNamedPipeFile \??\pipe\abc -Disposition OpenIf</code> <para>Creates a new file named pipe object with an absolute path. If the file already exists then open it rather than failing.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.Disposition"> <summary> <para type="description">Specify the disposition for creating the file.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.DefaultTimeoutMs"> <summary> <para type="description">Specify the default timeout for the pipe in MS</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.PipeType"> <summary> <para type="description">Specify the pipe type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.ReadMode"> <summary> <para type="description">Specify the pipe read mode.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.CompletionMode"> <summary> <para type="description">Specify the pipe completion mode.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.MaximumInstances"> <summary> <para type="description">Specify the maximum number of pipe instances (-1 is infinite).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.UnlimitedInstances"> <summary> <para type="description">If specified an unlimited number of instances of this pipe can be created.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.InputQuota"> <summary> <para type="description">Specify the pipe input quota (0 is default).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.OutputQuota"> <summary> <para type="description">Specify the pipe output quota (0 is default).</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtNamedPipeFileCmdlet.#ctor"> <summary> Constructor </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet"> <summary> <para type="synopsis">Creates a new security attribute.</para> <para type="description">This cmdlet creates a new security attribute object.</para> </summary> <example> <code>New-NtSecurityAttribute -Name "TEST://ME" -StringValue "ABC"</code> <para>Creates the security attribute TEST://ME with the string value "ABC".</para> </example> <example> <code>New-NtSecurityAttribute -Name "TEST://ME2" -LongValue 1,10,30,100</code> <para>Creates the security attribute TEST://ME2 with the long values 1, 10, 30 and 100.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.Name"> <summary> <para type="description">Specify the name of the attribute to add or update.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.Flags"> <summary> <para type="description">Specify the attribute flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.StringValue"> <summary> <para type="description">Specify the string values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.ULongValue"> <summary> <para type="description">Specify the ulong values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.LongValue"> <summary> <para type="description">Specify the long values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.BoolValue"> <summary> <para type="description">Specify the bool values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.SidValue"> <summary> <para type="description">Specify the SID values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.FqbnValue"> <summary> <para type="description">Specify the fully qualified binary name values.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.OctetValue"> <summary> <para type="description">Specify the octet values.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSecurityAttributeCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet"> <summary> <para type="synopsis">Create a new security descriptor which can be used on NT objects.</para> <para type="description">This cmdlet creates a new instance of a SecurityDescriptor object. This can be used directly with one of the New-Nt* cmdlets (via the -SecurityDescriptor parameter) or by calling SetSecurityDescriptor on an existing object (assume the object has been opened with the correct permissions. </para> </summary> <example> <code>$sd = New-NtSecurityDescriptor</code> <para>Create a new empty security descriptor object.</para> </example> <example> <code>$sd = New-NtSecurityDescriptor "O:BAG:BAD:(A;;GA;;;WD)"</code> <para>Create a new security descriptor object from an SDDL string</para> </example> <example> <code>$sd = New-NtSecurityDescriptor -NullDacl</code> <para>Create a new security descriptor object with a NULL DACL.</para> </example> <example> <code>$sd = New-NtSecurityDescriptor "D:(A;;GA;;;WD)"
$obj = New-NtDirectory \BaseNamedObjects\ABC -SecurityDescriptor $sd</code> <para>Create a new object directory with an explicit security descriptor.</para> </example> <example> <code>$sd = New-NtSecurityDescriptor -Key $key -ValueName SD</code> <para>Create a new security descriptor with the contents from the key $Key and value "SD".</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.NullDacl"> <summary> <para type="description">Specify to create the security descriptor with a NULL DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.EmptyDacl"> <summary> <para type="description">Specify to create the security descriptor with an empty DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.NullSacl"> <summary> <para type="description">Specify to create the security descriptor with a NULL SACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.EmptySacl"> <summary> <para type="description">Specify to create the security descriptor with an empty SACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Owner"> <summary> <para type="description">Specify thr owner for the new SD.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Group"> <summary> <para type="description">Specify the group for the new SD.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Dacl"> <summary> <para type="description">Specify the DACL for the new SD. The ACL will be cloned.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Sacl"> <summary> <para type="description">Specify the the SACL for the new SD. The ACL will be cloned.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Sddl"> <summary> <para type="description">Specify to create the security descriptor from an SDDL representation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Base64"> <summary> <para type="description">Specify to create the security descriptor from an base64 string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Token"> <summary> <para type="description">Specify to create the security descriptor from the default DACL of a token object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.MapGeneric"> <summary> <para type="description">Specify mapping the generic accesses based on the NT Type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Type"> <summary> <para type="description">Specify a default NT type for the security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Container"> <summary> <para type="description">Specify the security descriptor is for a container.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Byte"> <summary> <para type="description">Specify a byte array containing the security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Key"> <summary> <para type="description">Specify a registry key to read the security descriptor from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.ValueName"> <summary> <para type="description">Specify a registry value name in the key to read the security descriptor from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.KeyValue"> <summary> <para type="description">Specify a registry key value to read the security descriptor from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Control"> <summary> <para type="description">Specify additional control flags to apply to the SD. Not all the flags are accepted.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.ObjectType"> <summary> <para type="description">Specify optional object types for the new security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.AutoInherit"> <summary> <para type="description">Specify auto-inherit flags for new security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Parent"> <summary> <para type="description">Specify parent for new security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.Creator"> <summary> <para type="description">Specify creator for new security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.EffectiveToken"> <summary> <para type="description">Specify to use the current Token for a new security descriptor.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSecurityDescriptorCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet"> <summary> <para type="synopsis">Create a new thread.</para> <para type="description">This cmdlet creates a new thread in a specified process.</para> </summary> <example> <code>$thread = New-NtThread -StartRoutine 0x12345678</code> <para>Create a new thread with a specified start routine address in the current process.</para> </example> <example> <code>$thread = New-NtThread -StartRoutine 0x12345678 -Argument 0x9ABCEDF</code> <para>Create a new thread with a specified start routine address and argument in the current process.</para> </example> <example> <code>$thread = New-NtThread -StartRoutine 0x12345678 -Process $proc</code> <para>Create a new thread with a specified start routine address in another process.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.StartRoutine"> <summary> <para type="description">Specify start address.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.Process"> <summary> <para type="description">Specify the process to start the thread in.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.Argument"> <summary> <para type="description">Specify initial argument for the thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.CreateFlags"> <summary> <para type="description">Specify create flags for the thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.ZeroBits"> <summary> <para type="description">Specify zero bits for the stack.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.StackSize"> <summary> <para type="description">Specify initial stack size.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.MaximumStackSize"> <summary> <para type="description">Specify maximum stack size.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtThreadCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet"> <summary> <para type="synopsis">Create a new NT token.</para> <para type="description">This cmdlet creates a new NT token kernel APIs. It needs SeCreateTokenPrivilege to succeed.</para> </summary> <example> <code>$token = New-NtToken -User "SY"</code> <para>Create a new LocalSystem token with no groups or privileges.</para> </example> <example> <code>$token = New-NtToken -User "SY" -Groups "BA","WD" -Privileges SeDebugPrivilege,SeImpersonatePrivilege</code> <para>Create a new LocalSystem token with two groups and two privileges.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.User"> <summary> <para type="description">Specify the user SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.Group"> <summary> <para type="description">Specify a list of groups.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.UserGroup"> <summary> <para type="description">Specify a list of groups. To add an Integrity Level specify an IL group.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.Privilege"> <summary> <para type="description">Specify a list of privileges.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.UserPrivilege"> <summary> <para type="description">Specify a list of privileges with full details of the flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.AuthenticationId"> <summary> <para type="description">Specify an authentication ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.TokenType"> <summary> <para type="description">Specify the token type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.ExpirationTime"> <summary> <para type="description">Specify the token expiration time.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.DefaultAcl"> <summary> <para type="description">Specify the token's default ACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.IntegrityLevel"> <summary> <para type="description">Specify the token's integrity level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.DeviceGroup"> <summary> <para type="description">Specify a list of device groups.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.DeviceAttribute"> <summary> <para type="description">Specify a list of device attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.UserAttribute"> <summary> <para type="description">Specify a list of user attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.MandatoryPolicy"> <summary> <para type="description">Specify token mandatory policy.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTokenCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet"> <summary> <para type="synopsis">Creates a new NT transaction object.</para> <para type="description">This cmdlet creates a new NT transaction object.</para> </summary> <example> <code>$obj = New-NtTransaction \BaseNamedObjects\ABC</code> <para>Create a transaction object with an absolute path.</para> </example> <example> <code>$obj = New-NtTransaction \BaseNamedObjects\ABC -PreferredNode 2</code> <para>Create a transaction object with an absolute path and preferred node 2.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtTransaction ABC -Root $root</code> <para>Create a transaction object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtTransaction ABC</code> <para>Create a transaction object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.UnitOfWork"> <summary> <para type="description">Specify an optional Unit of Work GUID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.TransactionManager"> <summary> <para type="description">Specify an optional Transaction Manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.CreateFlags"> <summary> <para type="description">Specify flags for transaction creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.IsolationLevel"> <summary> <para type="description">Specify an optional isolation level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.IsolationFlags"> <summary> <para type="description">Specify isolation falgs.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.Timeout"> <summary> <para type="description">Specify timeout in milliseconds (0 is Infinite).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.Description"> <summary> <para type="description">Specify an optional description.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTransactionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet"> <summary> <para type="synopsis">Creates a Window Station object by path.</para> <para type="description">This cmdlet creates a new Window Station object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = New-NtWindowStation \Windows\WindowStations\WinSta0</code> <para>Create a Window Station object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \Windows\WindowStations
$obj = New-NtWindowStation ABC -Root $root</code> <para>Create a Window Station object with a relative path. </para> </example> <example> <code>$obj = New-NtWindowStation -Path ABC -Win32Path</code> <para>Create a Window Station object from Win32 path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.KeyboardLayoutDll"> <summary> <para type="description">The DLL containing the Keyboard Layout information.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.LanguageId"> <summary> <para type="description">The language ID for the keyboard. E.g. 0x409.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.KeyboardLocale"> <summary> <para type="description">The keyboard local. E.g. 0x4090409.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtWindowStationCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet"> <summary> Base object cmdlet. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.Root"> <summary> <para type="description">An existing open NT object to use when Path is relative.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.Win32Path"> <summary> <para type="description">Use a Win32 path for lookups. For NT objects this means relative to BNO, for files means a DOS style path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.CloseRoot"> <summary> <para type="description">Automatically close the Root object when this cmdlet finishes processing. Useful for pipelines.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.CreateDirectories"> <summary> <para type="description">Create any necessary NtDirectory objects to create the required object. Will return the created directories as well as the object in the output. The new object will be the first entry in the list. This doesn't work when opening an object or creating keys/files.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.#ctor"> <summary> Base constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.VerifyParameters"> <summary> Verify the parameters, should throw an exception if parameters are invalid. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.GetBasePath"> <summary> Get the base object manager path for the current powershell directory. </summary> <returns>The base path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.ResolvePath"> <summary> Virtual method to resolve the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdlet.Dispose(System.Boolean)"> <summary> Dispose object. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdletWithAccess`1"> <summary> Base object cmdlet which has an access parameter. </summary> <typeparam name="T">The access enumeration type.</typeparam> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdletWithAccess`1.Access"> <summary> <para type="description">Specify the access rights for a new handle when creating/opening an object.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseCmdletWithAccess`1.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet"> <summary> Base object cmdlet. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.AttributeFlags"> <summary> <para type="description">Object Attribute flags used during Open/Create calls.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.SecurityDescriptor"> <summary> <para type="description">Set to provide an explicit security descriptor to a newly created object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.Inherit"> <summary> <para type="description">Set to mark the new handle as inheritable. Can be used with ObjectAttributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.Sddl"> <summary> <para type="description">Set to provide an explicit security descriptor to a newly created object in SDDL format.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.SecurityQualityOfService"> <summary> <para type="description">Set to provide an explicit security quality of service when opening files/namedpipes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.Close"> <summary> <para type="description">Close the object immediately and don't pass to the output. This is useful to create permanent objects without needing to close the handle manually.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.ScriptBlock"> <summary> <para type="description">Invoke a script block on the created object before writing it to the output. Can be used in combination with the Close to map objects to some value.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.#ctor"> <summary> Base constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.IsRawPath"> <summary> Indicates that the path is raw and should be passed through Base64 decode. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.CreateObject(System.String,NtApiDotNet.AttributeFlags,NtApiDotNet.NtObject,NtApiDotNet.SecurityQualityOfService,NtApiDotNet.SecurityDescriptor)"> <summary> Create object from components. </summary> <param name="path">The path to the object.</param> <param name="attributes">The object attributes.</param> <param name="root">The root object.</param> <param name="security_quality_of_service">Security quality of service.</param> <param name="security_descriptor">Security descriptor.</param> <returns>The created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.Dispose(System.Boolean)"> <summary> Dispose object. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.Finalize"> <summary> Finalizer. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdlet.System#IDisposable#Dispose"> <summary> Dispose object. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdletWithAccess`1"> <summary> Base object cmdlet which has an access parameter. </summary> <typeparam name="T">The access enumeration type.</typeparam> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdletWithAccess`1.Access"> <summary> <para type="description">Specify the access rights for a new handle when creating/opening an object.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NtObjectBaseNoPathCmdletWithAccess`1.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet"> <summary> <para type="synopsis">Receives a message on an ALPC port.</para> <para type="description">This cmdlet receives a message on an ALPC port.</para> </summary> <example> <code>$recv_msg = Receive-NtAlpcMessage -Port $port -ReceiveLength 80</code> <para>Receive a message of up to 80 bytes.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.Port"> <summary> <para type="description">Specify the port to send the message on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.Flags"> <summary> <para type="description">Specify send flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.TimeoutMs"> <summary> <para type="description">Specify optional timeout in MS.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.ReceiveLength"> <summary> <para type="description">Specify the maximum length of message to receive.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.ReceiveAttributes"> <summary> <para type="description">Specify receive attributes.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.ReceiveNtAlpcMessageCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet"> <summary> <para type="synopsis">Deletes a registry key.</para> <para type="description">This cmdlet deletes a registry key.</para> </summary> <example> <code>Remove-NtKey \Registry\Machine\SOFTWARE\ABC</code> <para>Deletes the \Registry\Machine\SOFTWARE\ABC key.</para> </example> <example> <code>Remove-NtKey \Registry\Machine\SOFTWARE\ABC -OpenLink</code> <para>Deletes the \Registry\Machine\SOFTWARE\ABC symbolic link key.</para> </example> <example> <code>Remove-NtKey -Path ABC -Root $key</code> <para>Deletes the key ABC under root $key.</para> </example> <example> <code>Remove-NtKey $key</code> <para>Deletes the existing key $key.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.Path"> <summary> <para type="description">The NT object manager path for the key to delete.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.Root"> <summary> <para type="description">The root object for the key to delete. Ignored if a Win32Path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.Win32Path"> <summary> <para type="description">Specify the path is a Win32 path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.Transaction"> <summary> <para type="description">Specify a transaction to delete the key under.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.OpenLink"> <summary> <para type="description">Specify that you want to remove a symbolic link.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.Key"> <summary> <para type="description">An existing key to delete.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveKeyCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet"> <summary> <para type="synopsis">Unloads a registry hive.</para> <para type="description">This cmdlet unloads a registry hive in the registry namespace.</para> </summary> <example> <code>Remove-NtKeyHive \Registry\Machine\ABC</code> <para>Unload the \Registry\Machine\ABC hive.</para> </example> <example> <code>Remove-NtKey \Registry\Machine\ABC -Flags ForceUnload</code> <para>Unload the \Registry\Machine\ABC hive, forcing the unload if necessary.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet.ResolvePath"> <summary> Virtual method to return the value of the Path variable. </summary> <returns>The object path.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet.Flags"> <summary> <para type="description">Specifes the flags for unloading the hive.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveKeyHiveCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>Always null.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet"> <summary> <para type="synopsis">Deletes a NT file object.</para> <para type="description">This cmdlet deletes a NT file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simply calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>Remove-NtFile \??\C:\path\file.exe</code> <para>Delete a file object with an absolute path.</para> </example> <example> <code>$root = Get-NtFile \??\C:\path
Remove-NtFile file.exe -Root $root</code> <para>Delete a file object with a relative path.</para> </example> <example> <code>Remove-NtFile c:\path\file.exe -Win32Path</code> <para>Delete a file object with an absolute win32 path.</para> </example> <example> <code>Remove-NtFile ..\..\..\path\file.exe -Win32Path</code> <para>Delete a file object with a relative win32 path.</para> </example> <example> <code>Remove-NtFile \??\C:\path\file.exe -PosixSemantics</code> <para>Delete a file object with POSIX semantics (needs Win10 RS3+).</para> </example> <example> <code>Remove-NtFile \??\C:\path\file.exe -DeleteReparsePoint</code> <para>Delete a file reparse point rather than following the link.</para> </example> <example> <code>Remove-NtFile \??\C:\path\file.exe -ShareMode Read</code> <para>Delete a file object specifying a Read sharemode.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet.PosixSemantics"> <summary> <para type="description">Specify whether to delete with POSIX semantics.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet.DeleteReparsePoint"> <summary> <para type="description">Specify whether to delete the reparse point or the target.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet.DispositionFlags"> <summary> <para type="description">Specify arbitrary flags for the disposition EX setting.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtFileObjectIdCmdlet"> <summary> <para type="synopsis">Remove the object ID for a file.</para> <para type="description">This cmdlet removes the object ID for a file.</para> </summary> <example> <code>Remove-NtFileObjectId -File $f</code> <para>Remove the object ID for the file.</para> </example> <example> <code>Remove-NtFileObjectId -Path "\??\c:\windows\notepad.exe"</code> <para>Remove the object ID for the file by path</para> </example> <example> <code>Remove-NtFileObjectId -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Remove the object ID for the file by win32 path</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtFileObjectIdCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtFileReparsePointCmdlet"> <summary> <para type="synopsis">Removes the reparse point buffer for file.</para> <para type="description">This cmdlet removes the reparse point buffer from an existing NT file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter. It will return the original reparse buffer that was removed.</para> </summary> <example> <code>Remove-NtFileReparsePoint \??\C:\XYZ</code> <para>Remove the reparse point with an absolute path.</para> </example> <example> <code>$root = Get-NtFile \??\C:\
Remove-NtFileReparsePoint XYZ -Root $root</code> <para>Remove the reparse point with a relative path.</para> </example> <example> <code>Remove-NtFileReparsePoint C:\XYZ -Win32Path</code> <para>Remove the reparse point with an absolute win32 path.</para> </example> <example> <code>Remove-NtFileReparsePoint ..\..\..\XYZ -Win32Path</code> <para>Remove the reparse point with a relative win32 path.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtFileReparsePointCmdlet.ReparseTag"> <summary> <para type="description">Specify an existing reparse tag to delete. Default is to query for the existing reparse tag.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtFileReparsePointCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtFileReparsePointCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtSecurityDescriptorAceCmdlet"> <summary> <para type="synopsis">Removes ACEs from a security descriptor.</para> <para type="description">This cmdlet removes ACEs from a security descriptor. </para> </summary> <example> <code>Remove-NtSecurityDescriptorAce $sd -Sid "WD"</code> <para>Remove all ACEs from DACL and SACL with the World SID.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Type Denied</code> <para>Remove all Denied ACEs from DACL.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Flags Inherited -AclType Dacl</code> <para>Remove all inherited ACEs from the DACL only.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Flags ObjectInherit,ContainerInherit -AllFlags</code> <para>Remove all ACEs with Flags set to ObjectInherit and ContainerInherit from the DACL and SACL.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Access 0x20019</code> <para>Remove all ACEs with the Access Mask set to 0x20019 from the DACL and SACL.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Filter { $_.IsConditionalAce }</code> <para>Remove all condition ACEs from the DACL and SACL.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Ace @($a1, $a2)</code> <para>Remove all ACEs which match a list from the DACL and SACL.</para> </example> <example> <code>@($a1, $a2) | Remove-NtSecurityDescriptorAce $sd</code> <para>Remove all ACEs which match a list from the DACL and SACL.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Sid "WD" -WhatIf</code> <para>Test what ACEs would be removed from DACL and SACL with the World SID.</para> </example> <example> <code>Remove-NtSecurityDescriptorAce $sd -Sid "WD" -Confirm</code> <para>Remove all ACEs from DACL and SACL with the World SID with confirmation.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtSecurityDescriptorAceCmdlet.Ace"> <summary> <para type="description">Specify list of ACEs to remove.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtSecurityDescriptorAceCmdlet.PassThru"> <summary> <para type="description">Return the ACEs removed by the operation.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtSecurityDescriptorAceCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtTokenSecurityAttributeCmdlet"> <summary> <para type="synopsis">Removes security attributes on an NT token.</para> <para type="description">This cmdlet removes security attributes on an NT token. It needs SeTcbPrivilege to succeed.</para> </summary> <example> <code>Remove-NtTokenSecurityAttribute -Token $token -Name "TEST://ME"</code> <para>Removes the security attribute TEST://ME.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtTokenSecurityAttributeCmdlet.Token"> <summary> <para type="description">Specify the token to set the attributes on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtTokenSecurityAttributeCmdlet.Name"> <summary> <para type="description">Specify the name of the attributes to remove.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtTokenSecurityAttributeCmdlet.Attribute"> <summary> <para type="description">Specify existing attribute values.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtTokenSecurityAttributeCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet"> <summary> <para type="synopsis">Renames a NT file object.</para> <para type="description">This cmdlet renamed a NT file object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simply calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>Rename-NtFile \??\C:\path\file.exe -NewName \??\c:\newpath\file.exe</code> <para>Rename a file object with an absolute path.</para> </example> <example> <code>Rename-NtFile \??\C:\path\file.exe -NewName \??\c:\newpath\file.exe -Link</code> <para>Create a link to a file object with an absolute path.</para> </example> <example> <code>Rename-NtFile c:\path\file.exe -Win32Path -NewName c:\newpath\file.exe -ResolveNewName</code> <para>Rename a file object with an absolute win32 path.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.Link"> <summary> <para type="description">Specify to create a link rather than do the rename.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.NewName"> <summary> <para type="description">Specify to create a link rather than do the rename.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.NewNameRoot"> <summary> <para type="description">Specify a root object for the new name. This is passed verbatim to the system call unless ResolveNewName is used.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.ResolveNewName"> <summary> <para type="description">Specify to resolve the new name to a full path based on win32 rules, otherwise it's passed verbatim.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.RenameFlags"> <summary> <para type="description">Specify arbitrary flags for the rename EX setting.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.ReplaceIfExists"> <summary> <para type="description">Replace the file if it exists.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RenameNtFileCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtAccessMaskCmdlet"> <summary> <para type="synopsis">Revokes specific bits on an access mask and returns the updated access mask.</para> <para type="description">This cmdlet revokes specific bits on an access mask and returns the updated access mask</para> </summary> <example> <code>$access = Remove-NtAccessMask $access WriteDac</code> <para>Remove WriteDac from the access.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtAccessMaskCmdlet.AccessMask"> <summary> <para type="description">The initial access mask to update.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtAccessMaskCmdlet.RevokeAccess"> <summary> <para type="description">The access mask to grant.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtAccessMaskCmdlet.RawRevokeAccess"> <summary> <para type="description">The raw access mask to grant.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtAccessMaskCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SecurityDescriptorAclType"> <summary> <para type="description">ACL type for ACE selection.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SecurityDescriptorAclType.Dacl"> <summary> Only select from the DACL. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SecurityDescriptorAclType.Sacl"> <summary> Only select from the SACL. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SecurityDescriptorAclType.Both"> <summary> Select from both ACL and SACL. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet"> <summary> <para type="synopsis">Selects ACEs from a Security Descriptor.</para> <para type="description">This cmdlet selects ACEs from a security descriptor. </para> </summary> <example> <code>Select-NtSecurityDescriptorAce $sd -Sid "WD"</code> <para>Select all ACEs from DACL and SACL with the World SID.</para> </example> <example> <code>Select-NtSecurityDescriptorAce $sd -Type Denied</code> <para>Select all Denied ACEs from DACL.</para> </example> <example> <code>Select-NtSecurityDescriptorAce $sd -Flags Inherited -AclType Dacl</code> <para>Select all inherited ACEs from the DACL only.</para> </example> <example> <code>Select-NtSecurityDescriptorAce $sd -Flags ObjectInherit,ContainerInherit -AllFlags</code> <para>Select all ACEs with Flags set to ObjectInherit and ContainerInherit from the DACL and SACL.</para> </example> <example> <code>Select-NtSecurityDescriptorAce $sd -Access 0x20019</code> <para>Select all ACEs with the Access Mask set to 0x20019 from the DACL and SACL.</para> </example> <example> <code>Select-NtSecurityDescriptorAce $sd -Filter { $_.IsConditionalAce }</code> <para>Select all condition ACEs from the DACL and SACL.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.#ctor"> <summary> Constuctor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.SecurityDescriptor"> <summary> <para type="description">Specify the security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Sid"> <summary> <para type="description">Specify to select ACE with SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.KnownSid"> <summary> <para type="description">Specify to select ACE with a Known SID. Overrides the Sid parameter.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Name"> <summary> <para type="description">Specify to select ACE with a user name. Overrides the Sid and KnownSid parameter.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Type"> <summary> <para type="description">Specify the type of ACE.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Flags"> <summary> <para type="description">Specify the ACE flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.AllFlags"> <summary> <para type="description">Specify the ACE flags must all match. The default is to select on a partial match.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Access"> <summary> <para type="description">Specify the access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.Filter"> <summary> <para type="description">Specify a filter to select.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.AclType"> <summary> <para type="description">Specify what ACLs to select the ACEs from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.First"> <summary> <para type="description">Only select the first ACE which matches the criteria.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.AsSecurityDescriptor"> <summary> <para type="description">Specify to return the result as a new security descriptor.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SelectNtSecurityDescriptorAceCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet"> <summary> <para type="synopsis">Sends a message on an ALPC port and optionally receives one as well.</para> <para type="description">This cmdlet sends a message on an ALPC port and optionally receives ones.</para> </summary> <example> <code>Send-NtAlpcMessage -Port $port -Message $msg</code> <para>Send a message on a port.</para> </example> <example> <code>$recv_msg = Send-NtAlpcMessage -Port $port -Message $msg -ReceiveLength 80 -Flags SyncMessage</code> <para>Send a message on a port and waits for a message of up to 80 bytes.</para> </example> <example> <code>Send-NtAlpcMessage -Port $port -Bytes @(0, 1, 2, 3)</code> <para>Send a message on a port from a byte array.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.Port"> <summary> <para type="description">Specify the port to send the message on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.Bytes"> <summary> <para type="description">Specify message to send from a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.Message"> <summary> <para type="description">Specify message to send.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.Flags"> <summary> <para type="description">Specify send flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.SendAttributes"> <summary> <para type="description">Specify send attributes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.TimeoutMs"> <summary> <para type="description">Specify optional timeout in MS.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.ReceiveLength"> <summary> <para type="description">Specify optional length of message to receive.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.ReceiveAttributes"> <summary> <para type="description">Specify receive attributes.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SendNtAlpcMessageCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GrantNtAccessMaskCmdlet"> <summary> <para type="synopsis">Grants specific bits on an access mask and returns the updated access mask.</para> <para type="description">This cmdlet grants specific bits on an access mask and returns the updated access mask</para> </summary> <example> <code>$access = Grant-NtAccessMask $access WriteDac</code> <para>Adds WriteDac to the access.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GrantNtAccessMaskCmdlet.AccessMask"> <summary> <para type="description">The initial access mask to update.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GrantNtAccessMaskCmdlet.SetAccess"> <summary> <para type="description">The access mask to grant.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GrantNtAccessMaskCmdlet.RawSetAccess"> <summary> <para type="description">The raw access mask to grant.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GrantNtAccessMaskCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SendNtFileControlFunc"> <summary> <para type="description">Choose the function to send the IO control code to.</para> </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SendNtFileControlFunc.Default"> <summary> Default, use FsControl for FSCTLs and DeviceIoControl for anything else. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SendNtFileControlFunc.FsControl"> <summary> Only send to FsControl. </summary> </member> <member name="F:NtObjectManager.Cmdlets.Object.SendNtFileControlFunc.DeviceIoControl"> <summary> Only send to DeviceIoControl. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet"> <summary> <para type="synopsis">Sends a control code to a file.</para> <para type="description">This cmdlet sends a control code to a file.</para> </summary> <example> <code>Send-NtFileControl -File $file -ControlCode 1234 -Input @(1, 2, 3, 4) -OutputLength 100</code> <para>Send the control code 1234 with input and a maximum output length of 100 bytes.</para> </example> <example> <code>Send-NtFileControl -File $file -ControlCode 4567 -OutputLength 100</code> <para>Send the control code 4567 with no input and a maximum output length of 100 bytes.</para> </example> <example> <code>Send-NtFileControl -File $file -ControlCode 4567 -Input @(1, 2, 3, 4)</code> <para>Send the control code 4567 with input and no output.</para> </example> <example> <code>Send-NtFileControl -File $file -ControlCode 4567 -Input @(1, 2, 3, 4) -Function FsControl</code> <para>Send the control code 4567 with input and no output. Always sends to FsControl regardless of the control code.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.File"> <summary> <para type="description">The file object to send the control code to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.ControlCode"> <summary> <para type="description">The control code to send.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.Input"> <summary> <para type="description">The input bytes to send.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.OutputLength"> <summary> <para type="description">The number of bytes maximum to get from the output.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.Function"> <summary> <para type="description">Specify the IO control function to send to.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SendNtFileControlCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet"> <summary> <para type="synopsis">Creates a hardlink for a file.</para> <para type="description">This cmdlet creates a hard link to an existing file. The absolute path to the object in the NT object manager name space can be specified. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>New-NtFileHardlink -Path \??\C:\ABC\XYZ.TXT -LinkName \??\C:\TEMP\ABC.TXT</code> <para>Create a hardlink for file \??\C:\ABC\XYZ.TXT as \??\C:\XYZ.</para> </example> <example> <code>New-NtFileHardlink -Path C:\ABC\XYZ.TXT -LinkName C:\TEMP\ABC.TXT -Win32Path -ResolveLinkName</code> <para>Create a hardlink for file C:\ABC\XYZ.TXT as C:\TEMP\ABC.TXT.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.LinkName"> <summary> <para type="description">Specify the path to the new link. This is passed verbatim to the system call unless ResolveLinkName is used.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.LinkRoot"> <summary> <para type="description">Specify a root object if TargetPath is relative.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.ReplaceIfExists"> <summary> <para type="description">Specify to replace the target if it already exists.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.ResolveLinkName"> <summary> <para type="description">Specify to resolve the link name to a full path using win32 rules.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.LinkFlags"> <summary> <para type="description">Specify arbitrary flags for the link EX setting.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtFileHardlinkCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtFileAttributeCmdlet"> <summary> <para type="synopsis">Set the file attributes for a file.</para> <para type="description">This cmdlet sets the file attributes for a file.</para> </summary> <example> <code>Set-NtFileAttribute -File $f -FileAttribute Normal</code> <para>Set the file attributes for the file.</para> </example> <example> <code>Set-NtFileAttribute -Path "\??\c:\windows\notepad.exe" -FileAttribute Normal</code> <para>Set the file attributes for the file by path</para> </example> <example> <code>Set-NtFileAttribute -Path "c:\windows\notepad.exe" -Win32Path -FileAttribute Normal</code> <para>Set the file attributes for the file by win32 path</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileAttributeCmdlet.FileAttribute"> <summary> <para type="description">Specify attributes to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileAttributeCmdlet.PassThru"> <summary> <para type="description">Specify to pass through the result.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileAttributeCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtFileCompressionCmdlet"> <summary> <para type="synopsis">Set the compression format for a file.</para> <para type="description">This cmdlet sets the compression format for a file.</para> </summary> <example> <code>Set-NtFileCompression -File $f -Format Default</code> <para>Set the compression format for the file.</para> </example> <example> <code>Set-NtFileCompression -Path "\??\c:\windows\notepad.exe" -Format Default</code> <para>Set the compression format for the file by path</para> </example> <example> <code>Set-NtFileCompression -Path "c:\windows\notepad.exe" -Win32Path -Format Default</code> <para>Set the compression format for the file by win32 path</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileCompressionCmdlet.PassThru"> <summary> <para type="description">Specify to pass through the result.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileCompressionCmdlet.Format"> <summary> <para type="description">Specify compression format to set.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileCompressionCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet"> <summary> <para type="synopsis">Set the object ID for a file.</para> <para type="description">This cmdlet sets the object ID for a file.</para> </summary> <example> <code>Set-NtFileObjectId -File $f</code> <para>Set the object ID for the file.</para> </example> <example> <code>Set-NtFileObjectId -Path "\??\c:\windows\notepad.exe"</code> <para>Set the object ID for the file by path</para> </example> <example> <code>Set-NtFileObjectId -Path "c:\windows\notepad.exe" -Win32Path</code> <para>Set the object ID for the file by win32 path</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.ObjectId"> <summary> <para type="description">Specify to the object ID to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.BirthVolumeId"> <summary> <para type="description">Specify birth volume ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.BirthObjectId"> <summary> <para type="description">Specify birth object ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.DomainId"> <summary> <para type="description">Specify domain ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.ExtendedInfo"> <summary> <para type="description">Specify extended information.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileObjectIdCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet"> <summary> <para type="synopsis">Sets the reparse point buffer for file.</para> <para type="description">This cmdlet sets the reparse point buffer data for a file. The absolute path to the object in the NT object manager name space can be specified. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>Set-NtFileReparsePoint \??\C:\ABC \??\C:\XYZ</code> <para>Sets the symbolic link for file \??\C:\ABC to point to \??\C:\XYZ.</para> </example> <example> <code>Set-NtFileReparsePoint \??\C:\ABC \??\C:\XYZ "BLAH BLAH"</code> <para>Sets the symbolic link for file \??\C:\ABC to point to \??\C:\XYZ with an explicit print name.</para> </example> <example> <code>Set-NtFileReparsePoint \??\C:\ABC \??\C:\XYZ -Directory</code> <para>Sets the symbolic link for directory \??\C:\ABC to point to \??\C:\XYZ.</para> </example> <example> <code>Set-NtFileReparsePoint C:\ABC ..\..\XYZ -Win32Path</code> <para>Sets the symbolic link for file C:\ABC to point to C:\XYZ using Win32 paths.</para> </example> <example> <code>Set-NtFileReparsePoint \??\C:\ABC ..\..\XYZ -Relative</code> <para>Sets the symbolic link for file \??\C:\ABC to point to ..\..\XYZ using a relative path.</para> </example> <example> <code>Set-NtFileReparsePoint \??\C:\ABC \??\C:\XYZ -MountPoint</code> <para>Sets the mount point for file \??\C:\ABC to point to \??\C:\XYZ.</para> </example> <example> <code>Set-NtFileReparsePoint \??\C:\ABC -ReparseBuffer $rp</code> <para>Sets the reparse buffer for file \??\C:\ABC using a raw reparse buffer.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.MountPoint"> <summary> <para type="description">Specify creating a mount point.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.TargetPath"> <summary> <para type="description">Specify the target path for reparse point.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.PrintName"> <summary> <para type="description">Specify a print name for the reparse point.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.Relative"> <summary> <para type="description">Specify the symlink target should be a relative path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.ReparseBuffer"> <summary> <para type="description">Specify the raw reparse point buffer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.Bytes"> <summary> <para type="description">Specify the raw reparse point buffer as bytes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.ExistingTag"> <summary> <para type="description">Specify an existing reparse tag to check when setting the reparse point (on RS1+).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.ExistingGuid"> <summary> <para type="description">Specify an existing GUID to check when setting the reparse point (on RS1+).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.Flags"> <summary> <para type="description">Specify flags to use when setting the reparse point (on RS1+).</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileReparsePointCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet"> <summary> <para type="synopsis">Call SetVolume on the file.</para> <para type="description">This cmdlet sets volume information to a file handle. </para> </summary> <example> <code>Set-NtFileVolumeInformation -Object $obj -InformationClass FileFsVolumeInformation -Bytes @(1, 2, 3, 4)</code> <para>Set the basic info class for the object.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.File"> <summary> <para type="description">Specify the file to set volume information to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.InformationClass"> <summary> <para type="description">Specify the information class to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.Bytes"> <summary> <para type="description">Sets the buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.Buffer"> <summary> <para type="description">Sets the buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.Value"> <summary> <para type="description">Sets the information as a blittable value type.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtFileVolumeInformationCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtKeySymbolicLinkTarget"> <summary> <para type="synopsis">Open and sets the symbolic link target for a key.</para> <para type="description">This cmdlet opens a existing NT key object and sets out the symbolic link target. The absolute path to the object in the NT object manager name space can be specified. It's also possible to open the object relative to an existing object by specified the -Root parameter. To simplify calling it's also possible to specify the path in a Win32 format when using the -Win32Path parameter.</para> </summary> <example> <code>Set-NtKeySymbolicLinkTarget -Path \Registry\Machine\SYSTEM\CurrentControlSet -Target \Registry\Machine\ABC</code> <para>Sets the CurrentControlSet symbolic link target.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtKeySymbolicLinkTarget.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeySymbolicLinkTarget.Target"> <summary> <para type="description">Specify a target for the symbolic link.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtKeySymbolicLinkTarget.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet"> <summary> <para type="synopsis">Assign a process to a Job object.</para> <para type="description">This cmdlet assigns a process to a Job object.</para> </summary> <example> <code>Set-NtProcessJob -Job $job -Process $process</code> <para>Assigns the process to the job object.</para> </example> <example> <code>Set-NtProcessJob -Job $job -Current</code> <para>Assigns the current process to the job object.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet.Job"> <summary> <para type="description">Specify the job object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet.Process"> <summary> <para type="description">Specify the list of processes to assign.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet.Current"> <summary> <para type="description">Specify the list of processes to assign.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet.PassThru"> <summary> <para type="description">Specify to pass through the process objects.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtProcessJobCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet"> <summary> <para type="synopsis">Set a NT token on a process or thread.</para> <para type="description">This cmdlet sets a token on a process or thread.</para> </summary> <example> <code>Set-NtToken -Token $token -Process $process</code> <para>Set a process' primary token.</para> </example> <example> <code>Set-NtToken -Token $token -Process $process -Duplicate</code> <para>Set a process' primary token, duplicating it before use.</para> </example> <example> <code>Set-NtToken -Token $token -ProcessId 1234</code> <para>Set a process' primary token from its PID.</para> </example> <example> <code>Set-NtToken -Token $token -Thread $thread</code> <para>Set a thread's impersonation token.</para> </example> <example> <code>Set-NtToken -Token $token -Thread $thread -Duplicate -ImpersonationLevel Identification</code> <para>Set a thread's impersonation token, duplicating as an Identification level token first..</para> </example> <example> <code>Set-NtToken -Token $token -ThreadId 1234</code> <para>Set a thread's impersonation token from its TID.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.Process"> <summary> <para type="description">Specify the process to set the token on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.ProcessId"> <summary> <para type="description">Specify the process to set the token on.as a PID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.Thread"> <summary> <para type="description">Specify the thread to set the token on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.ThreadId"> <summary> <para type="description">Specify the thread to set the token on as a TID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.Duplicate"> <summary> <para type="description">Duplicate the token before setting it.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.Token"> <summary> <para type="description">Specify the token to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.ImpersonationLevel"> <summary> <para type="description">Specify the impersonation level of the token to assign if -Duplicate is specified.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.IntegrityLevel"> <summary> <para type="description">Specify the integrity level of the token to set if -Duplicate is specified.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtTokenCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtTokenDefaultDacl"> <summary> <para type="synopsis">Set the Default DACL for a Token.</para> <para type="description">This cmdlet sets the Default DACL for a Token.</para> </summary> <example> <code>Set-NtTokenDefaultDacl -DefaultDacl $dacl</code> <para>Set current effective token's Default DACL.</para> </example> <example> <code>Set-NtTokenDefaultDacl -SecurityDescriptor $sd</code> <para>Set current effective token's Default DACL from a Security Descriptor.</para> </example> <example> <code>Set-NtTokenDefaultDacl -DefaultDacl $dacl -Token $token</code> <para>Set Default DACL for a Token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenDefaultDacl.DefaultDacl"> <summary> <para type="description">Specify the default DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenDefaultDacl.SecurityDescriptor"> <summary> <para type="description">Specify the default DACL as a Security Descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtTokenDefaultDacl.Token"> <summary> <para type="description">Specify the token to set the default DACL.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtTokenDefaultDacl.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.SpecificAccessType"> <summary> <para type="description">Enumeration for specific access type mapping.</para> </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet"> <summary> <para type="synopsis">Wait for an event on a debug object.</para> <para type="description">This cmdlet allows you to issue a wait for on a debug object. The timeout value is a combination of all the allowed time parameters, e.g. if you specify 1 second and 1000 milliseconds it will actually wait 2 seconds in total. Specifying -Infinite overrides the time parameters and will wait indefinitely.</para> </summary> <example> <code>$ev = Start-NtDebugWait $dbg</code> <para>Check for a debug event and return immediately.</para> </example> <example> <code>$ev = Start-NtDebugWait $dbg -Seconds 10</code> <para>Wait for 10 seconds for a debug event to be returned.</para> </example> <example> <code>$ev = Start-NtDebugWait $dbg -Infinite</code> <para>Wait indefinitely for a debug event to be returned.</para> </example> <example> <code>$ev = Start-NtDebugWait $dbg -Infinite -Alterable</code> <para>Wait indefinitely for a debug event to be returned in an alertable state.</para> </example> <example> <code>$ev = Start-NtDebugWait $dbg -Infinite -ContinueEvent $ev</code> <para>Continue a previous event with an explicit continue state for the event and wait indefinitely for a debug event to be returned.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.DebugObject"> <summary> <para type="description">Specify the debug object to wait on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.Alertable"> <summary> <para type="description">Specify the wait should be alertable.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.ContinueEvent"> <summary> <para type="description">Specify an event to continue before waiting.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.ContinueStatus"> <summary> <para type="description">If continue event specified then this is the status to use.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.StartNtDebugWaitCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet"> <summary> <para type="synopsis">Compare two SIDs against various criteria.</para> <para type="description">This cmdlet compares two SIDs against various criteria. The default is to compare for equality, however you can test Integrity Level or Trust Level SIDs for which dominates.</para> </summary> <example> <code>Compare-NtSid $sid1 $sid2</code> <para>Checks both SIDs are equal.</para> </example> <example> <code>Compare-NtSid $sid -KnownSid World</code> <para>Checks the SID equals the World SID.</para> </example> <example> <code>Compare-NtSid $sid -IntegrityLevel Low</code> <para>Checks if the left IL SID dominates Low IL.</para> </example> /// <example> <code>Compare-NtSid $sid1 $sid2 -Dominates</code> <para>Checks if the left SID dominates the right.</para> </example> <example> <code>Compare-NtSid $sid -TrustType Protected -TrustLevel WinTcb</code> <para>Checks if the left Trust SID dominates the ProtectedLight-Windows Trust Level.</para> </example> <example> <code>Compare-NtSid $sid1 $sid2 -Prefix</code> <para>Checks left SID is prefixed by the right. Note that both SIDs must be the same length, you probably want StartsWith.</para> </example> <example> <code>Compare-NtSid $sid1 $sid2 -StartsWith</code> <para>Checks left SID starts with the right. The right SID should be shorter than the left.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.Left"> <summary> <para type="description">Specify the left SID to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.Right"> <summary> <para type="description">Specify the right SID to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.KnownSid"> <summary> <para type="description">Specify the right SID to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.IntegrityLevel"> <summary> <para type="description">Specify the right SID to compare.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.TrustType"> <summary> <para type="description">Specify protected type for Trust SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.TrustLevel"> <summary> <para type="description">Specify level for Trust SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.Dominates"> <summary> <para type="description">Check if the left SID dominates the right. Supports IL or Trust Level SIDs.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.Prefix"> <summary> <para type="description">Check if prefix of one SID matches another.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.StartsWith"> <summary> <para type="description">Check if one SID starts with another.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.CompareNtSidCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet"> <summary> <para type="synopsis">Tests an access mask for empty or specific bits set.</para> <para type="description">This cmdlet tests if an access mask is empty or if one or all bits are set from a comparison access mask.</para> </summary> <example> <code>Test-NtAccessMask $access WriteDac</code> <para>Checks if an access mask has WriteDac access.</para> </example> <example> <code>Test-NtAccessMask $access WriteDac, ReadControl -All</code> <para>Checks if an access mask has WriteDac and ReadControl access.</para> </example> <example> <code>Test-NtAccessMask $access WriteDac, ReadControl</code> <para>Checks if an access mask has WriteDac or ReadControl access.</para> </example> <example> <code>Test-NtAccessMask $access -Empty</code> <para>Checks if an access mask is empty.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.AccessMask"> <summary> <para type="description">The access mask to test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.AccessCompare"> <summary> <para type="description">The access mask to compare to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.RawAccessCompare"> <summary> <para type="description">The raw access mask to compare to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.All"> <summary> <para type="description">Check all access is in the mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.Empty"> <summary> <para type="description">Test if access mask is empty.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.WriteRestricted"> <summary> <para type="description">Specify the GenericMapping to check if Access Mask would be Write Restricted.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtAccessMaskCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet"> <summary> <para type="synopsis">Checks a ACE conditional express evaluated to a true.</para> <para type="description">This cmdlet evaluates an ACE conditional express to see if a specified token would match.</para> </summary> <example> <code>Test-NtAceCondition -Token $token</code> <para>Checks if the token can be impersonated at impersonation level.</para> </example> <example> <code>Test-NtAceCondition -Condition "WIN://ABC == 100"</code> <para>Checks the expression "WIN://ABC == 100" matches the effective token.</para> </example> <example> <code>Test-NtAceCondition -Condition "WIN://ABC == 100" -Token $token</code> <para>Checks the expression "WIN://ABC == 100" matches a specified token.</para> </example> <example> <code>Test-NtAceCondition -ConditionData $ba</code> <para>Checks the expression as a byte array matches the effective token.</para> </example> <example> <code>Test-NtAceCondition -Ace $ace</code> <para>Checks the expression from a conditional ACE matches the effective token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.Token"> <summary> <para type="description">Specify the token to test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.Condition"> <summary> <para type="description">Specify the conditional expression as an SDDL string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.ConditionData"> <summary> <para type="description">Specify the conditional expression as a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.Ace"> <summary> <para type="description">Specify a conditional ACE. Note that only the conditional expression is used, not the Sid or Mask.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.ResourceAttribute"> <summary> <para type="description">Specify a list of resource attributes.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtAceConditionCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet"> <summary> <para type="synopsis">Checks if a SID is present in the Token's groups.</para> <para type="description">This cmdlet checks if a SID is present in a Token's groups. It supports checking for normal Groups, Restricted SIDs or Capabilites.</para> </summary> <example> <code>Test-NtTokenGroup -Token $token -Sid $sid</code> <para>Checks if SID is present in the normal Groups.</para> </example> <example> <code>Test-NtTokenGroup -Token $token -Sid $sid -DenyOnly</code> <para>Checks if SID is present in the normal Groups including DenyOnly groups.</para> </example> <example> <code>Test-NtTokenGroup -Token $token -Sid $sid -Restricted</code> <para>Checks if SID is present in the normal Groups.</para> </example> <example> <code>Test-NtTokenGroup -Token $token -Sid $sid -Capability</code> <para>Checks if SID is present in the normal Groups.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.Token"> <summary> <para type="description">Specify the token to test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.Sid"> <summary> <para type="description">Specify the SID to test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.Restricted"> <summary> <para type="description">Specify the to test the Restricted SIDs.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.Capability"> <summary> <para type="description">Specify the to test the Capability SIDs.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.DenyOnly"> <summary> <para type="description">Specify to also check DenyOnly SIDs.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtTokenGroupCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet"> <summary> <para type="synopsis">Checks if an NT Token can be impersonated.</para> <para type="description">This cmdlet impersonates an NT Token and checks if the impersonation level matches.</para> </summary> <example> <code>Test-NtTokenImpersonation -Token $token</code> <para>Checks if the token can be impersonated at impersonation level.</para> </example> <example> <code>Test-NtTokenImpersonation -Token $token -ImpersonationLevel Identification</code> <para>Checks if the token can be impersonated at identification level.</para> </example> <example> <code>Test-NtTokenImpersonation -Token $token -PassThru</code> <para>Impersonates the token and passes through the impersonated token.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.Token"> <summary> <para type="description">Specify the token to test.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.Thread"> <summary> <para type="description">Specify an optional thread to test on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.PassThru"> <summary> <para type="description">Pass through the impersonated Token rather than returning a boolean.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.ImpersonationLevel"> <summary> <para type="description">Specify the level of impersonation to check.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtTokenImpersonationCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet"> <summary> <para type="synopsis">Checks for enabled privileges in a token.</para> <para type="description">This cmdlet does a privilege check for a token. The default it to pass a boolean indicating the privilege enable state. You can specify PassResult to get the full result information.</para> </summary> <example> <code>Test-NtTokenPrivilege SeTcbPrivilege</code> <para>Checks if the current effective token has SeTcbPrivilege enabled.</para> </example> <example> <code>Test-NtTokenPrivilege SeTcbPrivilege,SeDebugPrivilege</code> <para>Checks if the current effective token has either SeTcbPrivilege or SeDebugPrivilege enabled.</para> </example> <example> <code>Test-NtTokenPrivilege SeTcbPrivilege,SeDebugPrivilege -All</code> <para>Checks if the current effective token has SeTcbPrivilege and SeDebugPrivilege enabled.</para> </example> <example> <code>Test-NtTokenPrivilege SeTcbPrivilege,SeDebugPrivilege -PassResult</code> <para>Checks if the current effective token has SeTcbPrivilege and SeDebugPrivilege enabled and pass on a result rather than just a boolean.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet.Token"> <summary> <para type="description">Specify the token to test. If not specified uses the current effective token.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet.PrivilegeValue"> <summary> <para type="description">Specify an optional thread to test on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet.All"> <summary> <para type="description">Specify that all the privileges are required.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet.PassResult"> <summary> <para type="description">Specify to pass through the full check result, otherwise just return a boolean which indicates whether the check succeeded.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.TestNtTokenPrivilegeCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.UseNtObjectCmdlet"> <summary> <para type="synopsis">Use an NtObject (or list of NtObject) and automatically close the objects after use.</para> <para type="description">This cmdlet allows you to scope the use of NtObject, similar to the using statement in C#. When the script block passed to this cmdlet goes out of scope the input object is automatically disposed of, ensuring any native resources are closed to prevent leaks. </para> </summary> <example> <code>$ps = Use-NtObject (Get-NtProcess) { param ($ps); $ps | Select-Object Name, CommandLine }</code> <para>Select Name and CommandLine from a list of processes and dispose of the list afterwards.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.UseNtObjectCmdlet.InputObject"> <summary> <para type="description">Specify the input object to be disposed.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.UseNtObjectCmdlet.ScriptBlock"> <summary> <para type="description">Specify the script block to execute.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.UseNtObjectCmdlet.ProcessRecord"> <summary> Overridden process record method </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet"> <summary> <para type="synopsis">Write manual security audit events.</para> <para type="description">This cmdlet allows you to write manual audit events. You must be SeAuditPrivilege for this to work.</para> </summary> <example> <code>$on_close = Write-NtAudit -Open -SubsystemName "Subsystem" -SecurityDescriptor $sd -Name "ABC" -AccessGranted</code> <para>Write an open object audit event.</para> </example> <example> <code>$on_close = Write-NtAudit -Close -SubsystemName "Subsystem" -HandleId 1234 -GeneratedOnClose</code> <para>Write a close object audit event.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.SecurityDescriptor"> <summary> <para type="description">Specify the security descriptor for the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.SubsystemName"> <summary> <para type="description">Specify the name of the subsystem.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.HandleId"> <summary> <para type="description">Specify the handle ID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.TypeName"> <summary> <para type="description">Specify the name of the object type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Name"> <summary> <para type="description">Specify the name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.ServiceName"> <summary> <para type="description">Specify the name of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Token"> <summary> <para type="description">Specify a token object for the audit event. If not specified then current effective token is used.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.DesiredAccess"> <summary> <para type="description">Specify the desired access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.GrantedAccess"> <summary> <para type="description">Specify the granted access.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Creation"> <summary> <para type="description">Specify the object was created.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.AccessGranted"> <summary> <para type="description">Specify if access granted was granted.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.GenerateOnClose"> <summary> <para type="description">Specify the generate on close flag.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Privileges"> <summary> <para type="description">Specify privileges.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Delete"> <summary> <para type="description">Specify to generate a delete audit event.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Close"> <summary> <para type="description">Specify to generate a close audit event.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.Open"> <summary> <para type="description">Specify to generate a open audit event.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.PrivilegeObject"> <summary> <para type="description">Specify to generate a privilege object audit event.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.PrivilegeService"> <summary> <para type="description">Specify to generate a privilege service audit event.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.WriteNtAuditCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet"> <summary> <para type="synopsis">Creates a new ALPC security context.</para> <para type="description">This cmdlet creates a new ALPC security context pages of a specified security quality of serice..</para> </summary> <example> <code>$ctx = New-NtAlpcSecurityContext -Port $port</code> <para>Create a new security context with default values.</para> </example> <example> <code>$ctx = New-NtAlpcSecurityContext -Port $port -ImpersonationLevel Identification</code> <para>Create a new security context with impersonation level of Identitification.</para> </example> <example> <code>$ctx = New-NtAlpcSecurityContext -Port $port -SecurityQualityOfService $sqos</code> <para>Create a new security context from a security quality of service.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.Port"> <summary> <para type="description">Specify the port to create the context from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.Flags"> <summary> <para type="description">Specify the creation flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.ImpersonationLevel"> <summary> <para type="description">Specify the impersonation level.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.ContextTrackingMode"> <summary> <para type="description">Specify the list of attributes for the receive buffer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.EffectiveOnly"> <summary> <para type="description">Specify the list of attributes for the receive buffer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.SecurityQualityOfService"> <summary> <para type="description">Specify the list of attributes for the receive buffer.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtAlpcSecurityContextCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.RemoveNtDebugProcessCmdlet"> <summary> <para type="synopsis">Detach a process from a debug object.</para> <para type="description">This cmdlet detachs a process remove a debug object.</para> </summary> <example> <code>Remove-NtDebugProcess $dbg -ProcessId 12345</code> <para>Detach process 12345 from the debug object..</para> </example> <example> <code>Remove-NtDebugProcess $dbg -Process $proc</code> <para>Detach process object from the debug object..</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtDebugProcessCmdlet.DebugObject"> <summary> <para type="description">Specify the debug object to debug the process from.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtDebugProcessCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to detach.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.RemoveNtDebugProcessCmdlet.Process"> <summary> <para type="description">Specify a process to detach.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.RemoveNtDebugProcessCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet"> <summary> <para type="synopsis">Creates a new NT Resource Manager object.</para> <para type="description">This cmdlet creates a new NT Resource Manager object.</para> </summary> <example> <code>$obj = New-NtEnlistment -ResourceManager $rm -Transaction $t </code> <para>Create an Enslitment with a Resource Manager and Transaction.</para> </example> <example> <code>$obj = New-NtEnlistment -AutoGenerateGuid -TransactionManager $tm </code> <para>Create a Resource Manager object with an auto-generated GUID.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.ResourceManager"> <summary> <para type="description">Specify the Resource Manager to contain the Enlistment.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.Transaction"> <summary> <para type="description">Specify the Transaction to associate with the Enlistment.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.CreateFlags"> <summary> <para type="description">Specify flags for Enlistment creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.NotificationMask"> <summary> <para type="description">Specify the notification mask for the Enlistment creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.EnlistmentKey"> <summary> <para type="description">Specify a key to associate with the Enlistment.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtEnlistmentCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet"> <summary> <para type="synopsis">Creates a new NT partition object.</para> <para type="description">This cmdlet creates a new NT partition object.</para> </summary> <example> <code>$obj = New-NtPartition \BaseNamedObjects\ABC</code> <para>Create a partition object with an absolute path.</para> </example> <example> <code>$obj = New-NtPartition \BaseNamedObjects\ABC -PreferredNode 2</code> <para>Create a partition object with an absolute path and preferred node 2.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtPartition ABC -Root $root</code> <para>Create a partition object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtPartition ABC</code> <para>Create a partition object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet.PreferredNode"> <summary> <para type="description">Specifies the preferred NUMA node, -1 means ideal node.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet.ParentPartition"> <summary> <para type="description">Specifies the parent partition. Not specifying means use the system partition.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtPartitionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet"> <summary> <para type="synopsis">Creates a new NT Resource Manager object.</para> <para type="description">This cmdlet creates a new NT Resource Manager object.</para> </summary> <example> <code>$obj = New-NtResourceManager -TransactionManager $tm </code> <para>Create a Resource Manager object with an auto-generated GUID.</para> </example> <example> <code>$obj = New-NtResourceManager -ResourceManagerGuid '04422e91-63c2-4025-944d-d66fae133274' -TransactionManager $tm </code> <para>Create a Resource Manager object with a specified GUID.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.ResourceManagerGuid"> <summary> <para type="description">Specify the Resource Manager GUID to create.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.TransactionManager"> <summary> <para type="description">Specify the Transaction Manager to contain the Resource Manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.CreateFlags"> <summary> <para type="description">Specify flags for resource manager creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.Description"> <summary> <para type="description">Specify an optional description.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtResourceManagerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTransactionGuidCmdlet"> <summary> <para type="synopsis">Enumerates Kernel Transaction Manager object GUIDs.</para> <para type="description">This cmdlet enumerates exiting Kernel Transaction Manager objects and returns the GUIDs associaed with the objects.</para> </summary> <example> <code>$obj = Get-NtTransactionGuid -Type Transaction</code> <para>Get all transaction object GUIDs.</para> </example> <example> <code>$obj = Get-NtTransactionGuid -Type TransactionManager</code> <para>Get all transaction manager object GUIDs.</para> </example> <example> <code>$obj = Get-NtTransactionGuid -Type Transaction -TransactionManager $tm</code> <para>Get all transaction object GUIDs from a transaction manager.</para> </example> <example> <code>$obj = Get-NtTransactionGuid -Type ResourceManager -TransactionManager $tm</code> <para>Get all resource manager object GUIDs from a transaction manager.</para> </example> <example> <code>$obj = Get-NtTransactionGuid -Type Enlistment -ResourceManager $rm</code> <para>Get all enlistment object GUIDs from a resource manager.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionGuidCmdlet.Type"> <summary> <para type="description">Specify the object type for the enumeration.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionGuidCmdlet.ResourceManager"> <summary> <para type="description">Specify the Resource Manager for the enumeration (needed for enlistments).</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTransactionGuidCmdlet.TransactionManager"> <summary> <para type="description">Specify the Transaction Manager for the enumeration (needed for resource manager, optional for transactions).</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTransactionGuidCmdlet.ProcessRecord"> <summary> Process records. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet"> <summary> <para type="synopsis">Creates a new NT transaction manager object.</para> <para type="description">This cmdlet creates a new NT transaction object.</para> </summary> <example> <code>$obj = New-NtTransaction \BaseNamedObjects\ABC</code> <para>Create a transaction manager object with an absolute path.</para> </example> <example> <code>$obj = New-NtTransaction \BaseNamedObjects\ABC -PreferredNode 2</code> <para>Create a transaction manager object with an absolute path and preferred node 2.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtTransaction ABC -Root $root</code> <para>Create a transaction manager object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtTransaction ABC</code> <para>Create a transaction manager object with a relative path based on the current location. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.CreateFlags"> <summary> <para type="description">Specify flags for transaction manager creation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.CommitStrength"> <summary> <para type="description">Specify an optional commit strength.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.LogFileName"> <summary> <para type="description">Specify an optional log file name.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtTransactionManagerCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet"> <summary> <para type="synopsis">Open a Window Station object by path.</para> <para type="description">This cmdlet opens an existing Window Station object. The absolute path to the object in the NT object manager name space must be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter.</para> </summary> <example> <code>$obj = Get-NtWindowStation</code> <para>Get all accessible Window Stations.</para> </example> <example> <code>$obj = Get-NtWindowStation \Windows\WindowStations\WinSta0</code> <para>Get a Window Station object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \Windows\WindowStations
$obj = Get-NtWindowStation ABC -Root $root</code> <para>Get a Window Station object with a relative path. </para> </example> <example> <code>$obj = Get-NtWindowStation -Path WinSta0 -Win32Path</code> <para>Get a Window Station object from Win32 path.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.Path"> <summary> <para type="description">The NT object manager path to the object to use.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.Current"> <summary> <para type="description">The current Window Station.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.GetWin32Path(System.String)"> <summary> Get the Win32 path for a specified path. </summary> <param name="path">The path component.</param> <returns>The full NT path.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtWindowStationCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtEventCmdlet"> <summary> <para type="synopsis">Create a new NT event object.</para> <para type="description">This cmdlet creates a new NT event object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtEvent</code> <para>Create a new anonymous event object.</para> </example> <example> <code>$obj = New-NtEvent \BaseNamedObjects\ABC</code> <para>Create a new event object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtEvent ABC -Root $root</code> <para>Create a new event object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtEvent ABC</code> <para>Create a new event object with a relative path based on the current location. </para> </example> <example> <code>$obj = New-NtEvent -InitialState $true</code> <para>Create a new anonymous event object with it initially set.</para> </example> <example> <code>$obj = New-NtEvent -Path \BaseNamedObjects\ABC
$obj.Wait()</code> <para>Create a new event object, wait for it to be set.</para> </example> <example> <code>$obj = New-NtEvent -Path \BaseNamedObjects\ABC
$obj.Set()</code> <para>Create a new event object, and set it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtEventCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEventCmdlet.InitialState"> <summary> <para type="description">The initial state of the event object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtEventCmdlet.EventType"> <summary> <para type="description">The type of event to create.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtEventCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet"> <summary> <para type="synopsis">Formats Job information.</para> <para type="description">This cmdlet formats the Job information. Can either take a list of jobs or a process.</para> </summary> <example> <code>Format-NtJob -Job $job</code> <para>Formats a job.</para> </example> <example> <code>Format-NtJob -Process $process</code> <para>Formats all accessible jobs for a process.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet.Process"> <summary> <para type="description">Specify the process to format job information.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet.Job"> <summary> <para type="description">Specify the process to format job information.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet.Filter"> <summary> <para type="description">Specify what parts of the job to format.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.FormatNtJobCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet"> <summary> <para type="synopsis">Get NT processes.</para> <para type="description">This cmdlet gets all accessible processes on the system. You can specify a specific process by setting the -ProcessId or -Current parameters.</para> <para>Note that process objects need to be disposed of after use, therefore capture them in a Dispose List or manually Close them once used. You can specify some specific filters for the list of processes returned. The advantage of filtering here is the created NtProcess objects will be automatically disposed of when not needed.</para> </summary> <example> <code>$ps = Get-NtProcess</code> <para>Get all NT processes accessible by the current user.</para> </example> <example> <code>$p = Get-NtProcess -Current</code> <para>Get reference to current process.</para> </example> <example> <code>$ps = Get-NtProcess -Access DupHandle</code> <para>Get all NT processes accessible by the current user for duplicate handle access.</para> </example> <example> <code>$p = Get-NtProcess 1234</code> <para>Get a specific process</para> </example> <example> <code>$p = Get-NtProcess 1234 -Access QueryInformation
$p.CommandLine</code> <para>Get a command line of a specific process.</para> </example> <example> <code>$p = Get-NtProcess 1234 -Access QueryInformation
$p.FullPath</code> <para>Get a native image path of a specific process.</para> </example> <example> <code>$p = Get-NtProcess $pid</code> <para>Get the current process by process ID.</para> </example> <example> <code>$p = Get-NtProcess 1234 -OpenParent</code> <para>Get the parent of a specific process.</para> </example> <example> <code>$ps = Get-NtProcess -Name notepad.exe</code> <para>Get all processes with the name notepad.exe.</para> </example> <example> <code>$ps = Get-NtProcess -CommandLine hello</code> <para>Get all processes with where the command line contains the string "hello".</para> </example> <example> <code>$ps = Get-NtProcess -Name notepad.exe -CommandLine hello</code> <para>Get all processes with the name notepad.exe where the command line contains the string "hello".</para> </example> <example> <code>$ps = Get-NtProcess -FilterScript { $_.SessionId -eq 1 }</code> <para>Get all processes in session 1.</para> </example> <example> <code>$ps = Get-NtProcess -FilterScript { $_.Mitigations.DisallowWin32kSystemCalls -eq $true }</code> <para>Get all processes with the Disallow Win32k System Calls mitigation policy.</para> </example> <example> <code>$p = Get-NtProcess -ServiceName WebClient</code> <para>Open the process which hosts the WebClient service, if it's running.</para> </example> <example> <code>Get-NtProcess -InfoOnly</code> <para>Get all process information, don't open the process objects.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.OpenParent"> <summary> <para type="description">When opening a specific process choose whether to open its parent instead.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.OpenOwner"> <summary> <para type="description">When opening a specific process choose whether to open its owner process (which is typically a console host) instead.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.Name"> <summary> <para type="description">Specify a executable name to filter the list on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.CommandLine"> <summary> <para type="description">Specify sub-string in the command line to filter the list on. If Name is also specified this will just select processes with that name with this sub-string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.ServiceName"> <summary> <para type="description">Get the process for the specified service name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.FilterScript"> <summary> <para type="description">Specify an arbitrary filter script.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.Access"> <summary> <para type="description">Specify access rights for each process opened.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.Current"> <summary> <para type="description">Open current process.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.FromSystem"> <summary> <para type="description">When getting all processes only get the system information process list.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.InfoOnly"> <summary> <para type="description">Only get process information, do not open the objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.IgnoreDeadProcess"> <summary> <para type="description">Ignore dead processes when getting process list.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.First"> <summary> <para type="description">Return only the specified number of processes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.NextProcess"> <summary> <para type="description">Specify the previous process to enumerate the next process.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtProcessCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet"> <summary> <para type="synopsis">Create a new NT section object.</para> <para type="description">This cmdlet creates a new NT section object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtSection -Size 4096</code> <para>Create a new anonymous section object of size 4096 bytes.</para> </example> <example> <code>$obj = New-NtSection \BaseNamedObjects\ABC -Size 4096</code> <para>Create a new section object with an absolute path.</para> </example> <example> <code>$file = Get-NtFile \??\C:\SomeFile
$obj = New-NtSection -File $file -Protection ReadOnly</code> <para>Create a new section object backed by a file with read only protection. </para> </example> <example> <code>$file = Get-NtFile \??\C:\Windows\notepad.exe
$obj = New-NtSection -File $file -SectionAttributes Image -Protection ReadOnly</code> <para>Create a new image section object backed by an executable file. </para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.File"> <summary> <para type="description">An existing file to use as backing for the section.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.Size"> <summary> <para type="description">An optional size for the section.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.Protection"> <summary> <para type="description">Memory allocation protection flags.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.SectionAttributes"> <summary> <para type="description">Section attribute flags.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSectionCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet"> <summary> <para type="synopsis">Create a new NT semaphore object.</para> <para type="description">This cmdlet creates a new NT semaphore object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtSemaphore</code> <para>Create a new anonymous semaphore object.</para> </example> <example> <code>$obj = New-NtSemaphore \BaseNamedObjects\ABC</code> <para>Create a new semaphore object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtSemaphore ABC -Root $root</code> <para>Create a new semaphore object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtSemaphore ABC</code> <para>Create a new semaphore object with a relative path based on the current location. </para> </example> <example> <code>$semaphore = New-NtSemaphore -MaximumCount 10</code> <para>Create a new anonymous semaphore object a maximum count of 10.</para> </example> <example> <code>$semaphore = New-NtSemaphore -InitialCount 1</code> <para>Create a new anonymous semaphore object the initial count set to 1.</para> </example> <example> <code>$obj = New-NtSemaphore -InitialCount 1
$semaphore.Wait(10)
# Do something with the semaphore...
$obj.Release(1)</code> <para>Create a new anonymous semaphore object with an initial count of 1, decrement the semaphore via Wait with a 10 second wait and Release it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet.InitialCount"> <summary> <para type="description">Specify the intial count of the semaphore.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet.MaximumCount"> <summary> <para type="description">Specify the maximum count of the semaphore.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSemaphoreCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet"> <summary> <para type="synopsis">Get NT threads.</para> <para type="description">This cmdlet gets all accessible threads on the system. You can specify a specific thread by setting the -ThreadId parameter.</para> <para>Note that thread objects need to be disposed of after use, therefore capture them in a Dispose List or manually Close them once used.</para> </summary> <example> <code>$ts = Get-NtThread</code> <para>Get all NT threads accessible by the current user.</para> </example> <example> <code>$ts = Get-NtThread -Access Impersonate</code> <para>Get all NT threads accessible by the current user for impersonate access.</para> </example> <example> <code>$t = Get-NtThread 1234</code> <para>Get a specific thread.</para> </example> <example> <code>$t = Get-NtThread -ProcessId 1234</code> <para>Get threads for a specific process.</para> </example> <example> <code>$ts = Get-NtThread -Current</code> <para>Get the current NT thread.</para> </example> <example> <code>$ts = Get-NtThread -FilterScript { Use-NtObject($k = $_.OpenToken()) { $k -ne $null } }</code> <para>Get threads which have impersonation tokens set.</para> </example> <example> <code>Get-NtThread -InfoOnly</code> <para>Get all thread information, but don't open the thread objects.</para> </example> <example> <code>Get-NtThread -InfoOnly -ProcessId $pid</code> <para>Get all thread information for the current process, but don't open the thread objects.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.ThreadId"> <summary> <para type="description">Specify a thread ID to open.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to enumerate only its threads.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.Current"> <summary> <para type="description">Get the current thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.PseudoHandle"> <summary> <para type="description">When getting the current thread return pseudo handle. This handle doesn't need to be closed but changes identity if used in a different thread.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.FilterScript"> <summary> <para type="description">Specify an arbitrary filter script.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.Access"> <summary> <para type="description">Specify access rights for each thread opened.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.FromSystem"> <summary> <para type="description">When getting all threads only get the system information thread list.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.First"> <summary> <para type="description">Return only the specified number of threads.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.InfoOnly"> <summary> <para type="description">Only get thread information, do not open the objects.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.Process"> <summary> <para type="description">Specify a process to enumerate only its threads.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.NextThread"> <summary> <para type="description">Specify the previous thread to enumerate the next thread.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtThreadCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup"> <summary> <para type="description">Handle group.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.Count"> <summary> The mumber of handles in the group. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.ShareCount"> <summary> Number of processes this kernel object is shared with. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.ProcessIds"> <summary> The list of unique process IDs. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.Object"> <summary> The name of the key. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.Handles"> <summary> The group enumeration. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.SecurityDescriptor"> <summary> Get the security descriptor for the handle group. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.Name"> <summary> Get the name for the handle group. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.HasName"> <summary> Does the group have a name. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.HasSecurityDescriptor"> <summary> Does the group have a security descriptor. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.AccessIntersection"> <summary> The intersection of all handle access. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NtHandleObjectGroup.AccessUnion"> <summary> The union of all handle access. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet"> <summary> <para type="synopsis">Get NT handle information.</para> <para type="description">This cmdlet gets handle information for all process on the system. You can specify a specific process by setting the -ProcessId parameter.</para> <para>By default extra information about the handle will be queried. This comes at a cost and could cause the process to hang, therefore if you don't want to query pass the -NoQuery parameter.</para> </summary> <example> <code>Get-NtHandle</code> <para>Get all NT handles.</para> </example> <example> <code>Get-NtHandle 1234</code> <para>Get all NT handles filtered to a specific Process ID</para> </example> <example> <code>Get-NtHandle $pid</code> <para>Get all NT handles for the current process.</para> </example> <example> <code>Get-NtHandle -Process $p</code> <para>Get all NT handles for a process.</para> </example> <example> <code>Get-NtHandle 1234 -NoQuery</code> <para>Get all NT handles filtered to a specific Process ID but don't try and query information about the handle such as name.</para> </example> /// <example> <code>Get-NtHandle -GroupByAddress</code> <para>Get all NT handles grouped by their object address.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.ProcessId"> <summary> <para type="description">Specify a process ID to filter handles on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.Process"> <summary> <para type="description">Specify a process to query handles for.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.NoQuery"> <summary> <para type="description">Specify that the returned handle entries should not be queried for additional information.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.ForceFileQuery"> <summary> <para type="description">Specify that the returned handle entries should force querying for file information from non-filesystem files. This is not the default as it can cause the lookup of filenames and security descriptors to hang.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.ObjectType"> <summary> <para type="description">Specify list of object types to filter handles.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.GroupByAddress"> <summary> <para type="description">Specify the result should be grouped by address.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtHandleCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtDirectoryChildCmdlet"> <summary> <para type="synopsis">Get the accessible children of an object directory.</para> <para type="description">This cmdlet gets the children of a directory object. It allows the children to be extracted recursively. You can choose to get the children through the pipeline or specify a vistor script. </para> </summary> <example> <code>$ds = Get-NtDirectoryChild $dir</code> <para>Get immediate children of an object directory.</para> </example> <example> <code>$ds = Get-NtDirectoryChild $dir -Recurse</code> <para>Get children of an object directory recursively.</para> </example> <example> <code>$ds = Get-NtDirectoryChild $dir -Recurse -MaxDepth 2</code> <para>Get children of an object directory recursively up to a maximum depth of 2.</para> </example> <example> <code>$ds = Get-NtDirectoryChild $dir Access ReadControl</code> <para>Get children of an object directory which can be opened for ReadControl access.</para> </example> <example> <code>Get-NtDirectoryChild $dir -Visitor { $path = $_.FullPath; Write-Host $path }</code> <para>Get children of an object directory via the visitor pattern.</para> </example> <example> <code>Get-NtDirectoryChild $dir -Recurse -Visitor { $path = $_.FullPath; Write-Host $path; $path -notmatch "BLAH" }</code> <para>Get children of an object directory via the visitor pattern, exiting the recursion if the object path contains the string BLAH.</para> </example> <example> <code>$ds = Get-NtDirectoryChild $dir -Recurse -Filter { $_.FullPath -match "BLAH" }</code> <para>Get children of an object directory filtering out any objects which don't have BLAH in the name.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtDirectoryChildCmdlet.VisitChildObjects(System.Func{NtApiDotNet.NtDirectory,System.Boolean})"> <summary> Overridden visit method. </summary> <param name="visitor">The visitor function.</param> <returns>Returns true if visited all children.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet"> <summary> <para type="synopsis">Get the accessible children of a file directory.</para> <para type="description">This cmdlet gets the children of a file directory object. It allows the children to be extracted recursively. You can choose to get the children through the pipeline or specify a vistor script. </para> </summary> <example> <code>$files = Get-NtFileChild $file</code> <para>Get immediate children of a file directory.</para> </example> <example> <code>$files = Get-NtFileChild $file -Streams</code> <para>Get immediate children and any streams of a file.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse</code> <para>Get children of a file directory recursively.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse -OpenForBackup</code> <para>Get children of a file directory recursively.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse -MaxDepth 2</code> <para>Get children of a file directory recursively up to a maximum depth of 2.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse -FileMask *.txt</code> <para>Get children of a file directory recursively, only returning files which match the pattern *.txt.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse -TypeMask DirectoriesOnly</code> <para>Get children of a file directory recursively, only returning directories.</para> </example> <example> <code>$files = Get-NtFileChild $file Access ReadControl</code> <para>Get children of a file directory which can be opened for ReadControl access.</para> </example> <example> <code>Get-NtFileChild $file -Visitor { $path = $_.FullPath; Write-Host $path }</code> <para>Get children of a file directory via the visitor pattern.</para> </example> <example> <code>Get-NtFileChild $file -Recurse -Visitor { $path = $_.FullPath; Write-Host $path; $path -notmatch "BLAH" }</code> <para>Get children of a file directory via the visitor pattern, exiting the recursion if the object path contains the string BLAH.</para> </example> <example> <code>$files = Get-NtFileChild $file -Recurse -Filter { $_.FullPath -match "BLAH" }</code> <para>Get children of a file directory filtering out any objects which don't have BLAH in the name.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.BeginProcessing"> <summary> Overridden BeginProcessing. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.OpenForBackup"> <summary> <para type="description">Open keys for backup. Needs SeBackupPrivilege enabled.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.Streams"> <summary> <para type="description">Get named streams of files as well as children.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.DirectoryAccess"> <summary> <para type="description">Specify file access using directory access rights.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.ShareMode"> <summary> <para type="description">The access share mode to open the files with.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.FileMask"> <summary> <para type="description">Specify a filter name filter such as *.txt.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.TypeMask"> <summary> <para type="description">Specify the types of files to return.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtFileChildCmdlet.VisitChildObjects(System.Func{NtApiDotNet.NtFile,System.Boolean})"> <summary> Overridden visit method. </summary> <param name="visitor">The visitor function.</param> <returns>Returns true if visited all children.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet"> <summary> <para type="synopsis">Sets a registry key value.</para> <para type="description">This cmdlet sets a registry key value on a specific key.</para> </summary> <example> <code>Set-NtKeyValue -Key $key -String "Hello"</code> <para>Sets the default value to the string "Hello".</para> </example> <example> <code>Set-NtKeyValue -Key $key -Name ABC -MultiString "Hello","World!"</code> <para>Sets the value ABC to the multi-string "Hello" and "World!".</para> </example> <example> <code>Set-NtKeyValue -Key $key -Name ABC -ValueType Binary -Bytes @(1, 2, 3, 4)</code> <para>Sets the value ABC to the binary data value.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Key"> <summary> <para type="description">The key to set the value on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Name"> <summary> <para type="description">The name of the value to set. If not specified it will set the default value.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.String"> <summary> <para type="description">Specify the value as a string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.ExpandString"> <summary> <para type="description">Specify the value as an expanded string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.MultiString"> <summary> <para type="description">Specify the value as a string.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.ValueType"> <summary> <para type="description">Specify the value type when using bytes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Bytes"> <summary> <para type="description">Specify the value as an array of bytes.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Dword"> <summary> <para type="description">Specify the value as a dword.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.BigEndian"> <summary> <para type="description">Specify whether to set the dword as big endian or little endian.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Qword"> <summary> <para type="description">Specify the value as a qword.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.Value"> <summary> <para type="description">Specify the value from an existing NtKeyValue. The name is ignored.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtKeyValueCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtMutantCmdlet"> <summary> <para type="synopsis">Create a new NT mutant object.</para> <para type="description">This cmdlet creates a new NT mutant object (also known as a mutex). The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtMutant</code> <para>Create a new anonymous mutant object.</para> </example> <example> <code>$obj = New-NtMutant \BaseNamedObjects\ABC</code> <para>Create a new mutant object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \BaseNamedObjects
$obj = New-NtMutant ABC -Root $root</code> <para>Create a new mutant object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtMutant ABC</code> <para>Create a new mutant object with a relative path based on the current location. </para> </example> <example> <code>$mutant = New-NtMutant -InitialOwner</code> <para>Create a new anonymous mutant object with the caller as the initial owner.</para> </example> <example> <code>$obj = New-NtMutant
$mutant.Wait()
# Do something in lock...
$obj.Release()</code> <para>Create a new anonymous mutant object, acquire the lock via Wait and Release it.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtMutantCmdlet.InitialOwner"> <summary> <para type="description">Specify to indicate the caller is the initial owner of the mutant.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtMutantCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtMutantCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet"> <summary> <para type="synopsis">Call SetInformation on the object type.</para> <para type="description">This cmdlet sets information to an object handle. You specify the information class by name or number. </para> </summary> <example> <code>Set-NtObjectInformation -Object $obj -InformationClass BasicInfo -Bytes @(1, 2, 3, 4)</code> <para>Set the basic info class for the object.</para> </example> <example> <code>Set-NtObjectInformation -Object $obj -InformationClass 1 -Bytes @(1, 2, 3, 4)</code> <para>Query the info class 1 for the object.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.Object"> <summary> <para type="description">Specify the object to set information to.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.InformationClass"> <summary> <para type="description">Specify the information class to set. Can be a string or an integer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.Bytes"> <summary> <para type="description">Sets the buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.Buffer"> <summary> <para type="description">Sets the buffer rather than a byte array.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.Value"> <summary> <para type="description">Sets the information as a blittable value type.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.SetNtObjectInformationCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.GetNtTypeCmdlet"> <summary> <para type="synopsis">Get NT type information.</para> <para type="description">This cmdlet gets NT type information from the operating system. If run without parameters it'll retrieve all types. You can limit it to only one type using the -TypeName parameter. By default it will used cached versions of the type information as most of the time you don't need information such as how many objects are created, however if you want that current information specify the -CurrentStatus parameter.</para> </summary> <example> <code>Get-NtType</code> <para>Get all NT types.</para> </example> <example> <code>Get-NtType | Where-Object SecurityRequired -eq $False</code> <para>Get all NT types which don't require security.</para> </example> <example> <code>Get-NtType Directory</code> <para>Get the Directory NT type.</para> </example> <example> <code>Get-NtType Directory -CurrentStatus</code> <para>Get the Directory NT type with the current status of all information.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTypeCmdlet.TypeName"> <summary> <para type="description">Specify a specific NT type to retrieve.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.GetNtTypeCmdlet.CurrentStatus"> <summary> <para type="description">If set then will pull the latest information for the types rather than using cached data.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.GetNtTypeCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Object.NewNtSymbolicLinkCmdlet"> <summary> <para type="synopsis">Create a new NT symbolic link object.</para> <para type="description">This cmdlet creates a new NT symbolic link object. The absolute path to the object in the NT object manager name space can be specified. It's also possible to create the object relative to an existing object by specified the -Root parameter. If no path is specified than an unnamed object will be created which can only be duplicated by handle.</para> </summary> <example> <code>$obj = New-NtSymbolicLink -TargetPath \Symlink\Target</code> <para>Create a new anonymous symbolic link object.</para> </example> <example> <code>$obj = New-NtSymbolicLink \DosDevices\ABC \Symlink\Target</code> <para>Create a new symbolic link object with an absolute path.</para> </example> <example> <code>$root = Get-NtDirectory \DosDevices
$obj = New-NtSymbolicLink ABC \Symlink\Target -Root $root</code> <para>Create a new symbolic link object with a relative path. </para> </example> <example> <code>cd NtObject:\BaseNamedObjects
$obj = New-NtSymbolicLink ABC \Symlink\Target</code> <para>Create a new symbolic link object with a relative path based on the current location.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSymbolicLinkCmdlet.CanCreateDirectories"> <summary> Determine if the cmdlet can create objects. </summary> <returns>True if objects can be created.</returns> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSymbolicLinkCmdlet.TargetPath"> <summary> <para type="description">Specify the target NT object manager path to follow if processing this symbolic link.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.NewNtSymbolicLinkCmdlet.Global"> <summary> <para type="description">Specify to create a global symbolic link. You need SeTcbPrivilege for this call to succeed.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.NewNtSymbolicLinkCmdlet.CreateObject(NtApiDotNet.ObjectAttributes)"> <summary> Method to create an object from a set of object attributes. </summary> <param name="obj_attributes">The object attributes to create/open from.</param> <returns>The newly created object.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Object.StartNtWaitCmdlet"> <summary> <para type="synopsis">Wait on one or more NT objects to become signaled.</para> <para type="description">This cmdlet allows you to issue a wait on one or more NT objects until they become signaled. This is used for example to acquire a Mutant, decrement a Semaphore or wait for a Process to exit. The timeout value is a combination of all the allowed time parameters, e.g. if you specify 1 second and 1000 milliseconds it will wait 2 seconds in total. Specifying -Infinite overrides the time parameters and will wait indefinitely.</para> </summary> <example> <code>$ev = Get-NtEvent \BaseNamedObjects\ABC
Start-NtWait $ev -Second 10</code> <para>Get an event and wait for 10 seconds for it to be signaled.</para> </example> <example> <code>$ev = Get-NtEvent \BaseNamedObjects\ABC
$ev | Start-NtWait -Infinite</code> <para>Get an event and wait indefinitely for it to be signaled.</para> </example> <example> <code>$ev = Get-NtEvent \BaseNamedObjects\ABC
$ev | Start-NtWait -Infinite -Alertable</code> <para>Get an event and wait indefinitely for it to be signaled or alerted.</para> </example> <example> <code>$evs = @($ev1, $ev2)$
Start-NtWait $evs -WaitAll -Second 100</code> <para>Get a list of events and wait 100 seconds for all events to be signaled.</para> </example> <para type="link">about_ManagingNtObjectLifetime</para> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtWaitCmdlet.Object"> <summary> <para type="description">Specify a list of objects to wait on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtWaitCmdlet.Alertable"> <summary> <para type="description">Specify the wait should be alertable.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Object.StartNtWaitCmdlet.WaitAll"> <summary> <para type="description">Specify a multiple object wait should exit only when all objects becomes signaled.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Object.StartNtWaitCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.ClearAuthZSidCmdlet"> <summary> <para type="synopsis">Removes all SIDs from the AuthZ context..</para> <para type="description">This cmdlet allows you to remove all SIDs from an AuthZ context. You can specify normal, restricted or device SIDs.</para> </summary> <example> <code>Clear-AuthZSid $ctx</code> <para>Removes all normal SIDs in the context.</para> </example> <example> <code>Clear-AuthZSid $ctx -SidType Restricted</code> <para>Removes all restricted SIDs in the context.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ClearAuthZSidCmdlet.Context"> <summary> <para type="description">Specify the AuthZ client context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ClearAuthZSidCmdlet.SidType"> <summary> <para type="description">Specify the the type of SIDs to remove.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.ClearAuthZSidCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.ClearAuthZSidCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet"> <summary> <para type="synopsis">Gets the granted access using a Win32 security query.</para> <para type="description">This cmdlet allows you to determine the granted access to a particular resource using the Win32 APIs.</para> </summary> <example> <code>Get-Win32GrantedAccess -Type File -Name "c:\windows"</code> <para>Get the maximum access for a file object.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet.Name"> <summary> <para type="description">The name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet.Type"> <summary> <para type="description">The type of object represented by Name/Object/Handle. Default is File.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet.GetNtType"> <summary> Abstract method to get the NT type for the access check. </summary> <returns>The NT type.</returns> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32GrantedAccessCmdlet.GetSecurityDescriptor"> <summary> Abstract method to get the security descriptor for access checking. </summary> <returns>The security descriptor.</returns> </member> <member name="T:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet"> <summary> <para type="synopsis">Create a new KDC proxy with PowerShell handlers.</para> <para type="description">This cmdlet creates a KDC proxy instance with PowerShell scripts to filter requests and replies.</para> </summary> <example> <code>$proxy = New-KerberosKdcProxy -HandleRequest { $_.Format() | Out-Host } -HandleReply { $_.Format() | Out-Host }
$proxy.Start()</code> <para>Create a new KDC proxy and display the request and reply tokens.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.HandleRequest"> <summary> <para type="description">Specify a script block to handle the request.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.HandleReply"> <summary> <para type="description">Specify a script block to handle a reply.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.HandleError"> <summary> <para type="description">Specify a script block to handle an error in the proxy.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.Listener"> <summary> <para type="description">Specify the server listener.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.Hostname"> <summary> <para type="description">Specify the server hostname. If not specified then will use the current PDC for the domain.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.Port"> <summary> <para type="description">Specify the server TCP port.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.NewKerberosKDCProxyCmdlet.ProcessRecord"> <summary> Process the command. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet"> <summary> <para type="synopsis">Change the configuration of a service.</para> <para type="description">This cmdlet changes the configuration of a service either locally or remotely.</para> </summary> <example> <code>Set-Win32ServiceConfig -Name "DEMO" -Path "c:\target\path.exe"</code> <para>Set the binary path for the service DEMO.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Name"> <summary> <para type="description">Specify the name of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.MachineName"> <summary> <para type="description">Specify the name of target computer.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.DisplayName"> <summary> <para type="description">Specify the display name of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Type"> <summary> <para type="description">Specify the type of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Start"> <summary> <para type="description">Specify the start type of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.ErrorControl"> <summary> <para type="description">Specify error control of the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Path"> <summary> <para type="description">Specify the binary path to the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.TagId"> <summary> <para type="description">Specify the load order tag id.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.LoadOrderGroup"> <summary> <para type="description">Specify the load order group.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Dependencies"> <summary> <para type="description">Specify list of dependencies.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.UserName"> <summary> <para type="description">Specify the user name for the service.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.Password"> <summary> <para type="description">Specify password for the service user.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.LaunchProtected"> <summary> <para type="description">Specify the service protected type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.SidType"> <summary> <para type="description">Specify the service restricted SID type.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.RequiredPrivilege"> <summary> <para type="description">Specify the service required privilege.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.SetWin32ServiceConfigCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet"> <summary> <para type="synopsis">Adds a SID to the AuthZ context..</para> <para type="description">This cmdlet allows you to add SIDs to an AuthZ context. You can specify normal, restricted or device SIDs.</para> </summary> <example> <code>Add-AuthZSid $ctx -Sid "WD"</code> <para>Add the World SID to the normal groups in the context.</para> </example> <example> <code>Add-AuthZSid $ctx -KnownSid World"</code> <para>Add the World SID to the normal groups in the context.</para> </example> <example> <code>Add-AuthZSid $ctx -Sid "WD" -Attribute Enabled, Resource</code> <para>Add the World SID to the normal groups in the context.</para> </example> <example> <code>Add-AuthZSid $ctx -Sid "WD" -SidType Restricted</code> <para>Add the World SID to the restricted SID groups in the context.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.Context"> <summary> <para type="description">Specify the AuthZ client context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.Sid"> <summary> <para type="description">Specify the SIDs to add.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.KnownSid"> <summary> <para type="description">Specify the known SIDs to add.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.Attribute"> <summary> <para type="description">Specify the attributes for the SIDs to add.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.UserGroup"> <summary> <para type="description">Specify the user groups to add.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.SidType"> <summary> <para type="description">Specify the the type of SIDs to add.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.AddAuthZSidCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet"> <summary> <para type="synopsis">Gets the granted access to a security descriptor or object.</para> <para type="description">This cmdlet allows you to determine the granted access to a particular resource through a security descriptor using the AuthZ APIs.</para> </summary> <example> <code>Get-AuthZGrantedAccess $ctx $sd</code> <para>Get the maximum access for a security descriptor.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.Context"> <summary> <para type="description">Specify the AuthZ Client Context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.SecurityDescriptor"> <summary> <para type="description">Specify a security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.AdditionalSecurityDescriptor"> <summary> <para type="description">Specify list of additional SDs to merge in.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.RawAccess"> <summary> <para type="description">Specify an access mask to check against. Overrides GenericAccess.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.Principal"> <summary> <para type="description">Specify a principal SID to user when checking security descriptors with SELF SID.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.ObjectType"> <summary> <para type="description">Specify object types for access check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.Type"> <summary> <para type="description">Specify the NT type for the access check.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetAuthZGrantedAccessCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.GetRunningScheduledTaskCmdlet"> <summary> <para type="synopsis">Get a list of running scheduled tasks.</para> <para type="description">This cmdlet enumerates all running scheduled tasks.</para> </summary> <remarks>For best results this command should be run as an administrator.</remarks> <example> <code>Get-RunningScheduledTask</code> <para>Get all running scheduled tasks.</para> </example> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetRunningScheduledTaskCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet"> <summary> <para type="synopsis">Create a new AuthZ Client Context..</para> <para type="description">This cmdlet creates a new AuthZ Client Context.</para> </summary> <example> <code>New-AuthZContext -ResourceManager $rm</code> <para>Create a new AuthZ Client Context from a Resource Manager using the current effective Token.</para> </example> <example> <code>New-AuthZContext -ResourceManager $rm -Token $token</code> <para>Create a new AuthZ Client Context from a Resource Manager and Token.</para> </example> <example> <code>New-AuthZContext -ResourceManager $rm -Sid $user</code> <para>Create a new AuthZ Client Context from a Resource Manager and user SID.</para> </example> <example> <code>New-AuthZContext -ResourceManager $rm -Sid $user</code> <para>Create a new AuthZ Client Context from a Resource Manager and user SID.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet.ResourceManager"> <summary> <para type="description">Specify the Resource Manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet.Token"> <summary> <para type="description">Specify the Token to base the Client Context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet.Sid"> <summary> <para type="description">Specify the SID to base the Client Context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet.Flags"> <summary> <para type="description">Specify the flags for the Client Context.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.NewAuthZContextCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet"> <summary> <para type="synopsis">Create a new AuthZ Resource Manager..</para> <para type="description">This cmdlet creates a new AuthZ Resource Manager.</para> </summary> <example> <code>New-AuthZResourceManager</code> <para>Create a default AuthZ Resource Manager.</para> </example> <example> <code>New-AuthZResourceManager -Name "TestRM"</code> <para>Create a AuthZ Resource Manager with a name.</para> </example> <example> <code>New-AuthZResourceManager -Flags InitializeUnderImpersonation, NoAudit</code> <para>Create a AuthZ Resource Manager flags.</para> </example> <example> <code>New-AuthZResourceManager { $_.Type -EQ "DeniedCallback" }</code> <para>Create a AuthZ Resource Manager with a Callback ACE script block.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.Flags"> <summary> <para type="description">Flags for initialization. Defaults to NoAudit.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.Name"> <summary> <para type="description">Optional name for the Resource Manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.CallbackAceScriptBlock"> <summary> <para type="description">Optional script block for callback ACE handling.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.Server"> <summary> <para type="description">Network address for the server.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.ServerSpn"> <summary> <para type="description">The SPN for the server.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.ServiceType"> <summary> <para type="description">The service type for the remote server.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.NewAuthZResourceManagerCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet"> <summary> <para type="synopsis">Removes a SID from the AuthZ context..</para> <para type="description">This cmdlet allows you to removes SIDs from an AuthZ context. You can specify normal, restricted or device SIDs.</para> </summary> <example> <code>Remove-AuthZSid $ctx -Sid "WD"</code> <para>Removes the World SID from the normal groups in the context.</para> </example> <example> <code>Remove-AuthZSid $ctx -Sid "WD" -SidType Restricted</code> <para>Removes the World SID from the restricted SID groups in the context.</para> </example> <example> <code>Remove-AuthZSid $ctx -KnownSid World</code> <para>Removes the World SID from the normal groups in the context.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.Context"> <summary> <para type="description">Specify the AuthZ client context.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.Sid"> <summary> <para type="description">Specify the Sids to remove.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.KnownSid"> <summary> <para type="description">Specify the known SIDs to remove.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.UserGroup"> <summary> <para type="description">Specify the user groups to remove.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.SidType"> <summary> <para type="description">Specify the the type of SIDs to remove.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.RemoveAuthZSidCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.GetWin32ErrorCmdlet"> <summary> <para type="synopsis">Get known information about a WIN32 error code.</para> <para type="description">This cmdlet looks up an WIN32 error code and if possible prints the enumeration name and the message description. </para> </summary> <example> <code>Get-Win32Error</code> <para>Gets all known WIN32 error codes defined in this library.</para> </example> <example> <code>Get-Win32Error -Error 5</code> <para>Gets information about a specific WIN32 error code.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32ErrorCmdlet.Error"> <summary> <para type="description">Specify a WIN32 error code to retrieve.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32ErrorCmdlet.ProcessRecord"> <summary> Process record. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet"> <summary> <para type="synopsis">Gets a security descriptor using the Win32 APIs.</para> <para type="description">This cmdlet gets the security descriptor on an object using the Win32 GetSecurityInfo APIs. </para> </summary> <example> <code>Get-Win32SecurityDescriptor "c:\test"</code> <para>Get the security descriptor for file path c:\test.</para> </example> <example> <code>Get-Win32SecurityDescriptor -Object $obj -Type Kernel Dacl</code> <para>Get the DACL of a kernel object.</para> </example> <example> <code>Get-Win32SecurityDescriptor -Handle -Type Kernel $handle Dacl</code> <para>Get the DACL of a kernel object handle.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.Name"> <summary> <para type="description">The name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.SecurityInformation"> <summary> <para type="description">Specify the security information to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.Object"> <summary> <para type="description">Handle to an object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.Handle"> <summary> <para type="description">Handle to an object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.Type"> <summary> <para type="description">The type of object represented by Name/Object/Handle. Default is File.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.GetWin32SecurityDescriptorCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet"> <summary> <para type="synopsis">Remove a DOS device symlink.</para> <para type="description">This cmdlet removes a DOS device symlink.</para> </summary> <example> <code>Remove-DosDevice Z:</code> <para>Remove the Z: drive.</para> </example> <example> <code>Remove-DosDevice Z: \Device\HarddiskVolume1\windows -RawTargetPath</code> <para>Remove the Z: drive, which must point to \Device\HarddiskVolume1\Windows.</para> </example> <example> <code>Remove-DosDevice Z: c:\windows</code> <para>Remove the Z: drive, which must point to c:\Windows.</para> </example> <example> <code>Remove-DosDevice "\RPC Control\ABC"</code> <para>Remove '\RPC Control\ABC' symlink.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet.DeviceName"> <summary> <para type="description">The device name to create. If this string starts with a \ then the symlink will be created relative to the root of the object manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet.ExactMatchTargetPath"> <summary> <para type="description">Specify an exact target path to remove. If the symlink doesn't match this target then it will not be removed.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet.NoBroadcastSystem"> <summary> <para type="description">Don't broadcast the change to the desktop using WM_SETTINGCHANGE.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet.RawTargetPath"> <summary> <para type="description">Specify the TargetPath as a raw object manager path.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.RemoveDosDeviceCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet"> <summary> <para type="synopsis">Resets a security descriptor using the Win32 APIs.</para> <para type="description">This cmdlet resets the security descriptor on an object using the Win32 SetSecurityInfo APIs. </para> </summary> <example> <code>Reset-Win32SecurityDescriptor "c:\test" Dacl</code> <para>Reset the DACL of the file path c:\test.</para> </example> <example> <code>Reset-Win32SecurityDescriptor "c:\test" Dacl -KeepExplicit</code> <para>Reset the DACL of the file path c:\test keeping explicit ACEs.</para> </example> <example> <code>Reset-Win32SecurityDescriptor "c:\test" Dacl -ShowProgress</code> <para>Reset the DACL of the file path c:\test and show progress</para> </example> <example> <code>Reset-Win32SecurityDescriptor "c:\test" Dacl -SecurityDescriptor $sd</code> <para>Reset the DACL of the file path c:\test with an explicit SD.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.Name"> <summary> <para type="description">The name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.SecurityInformation"> <summary> <para type="description">Specify the security information to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.SecurityDescriptor"> <summary> <para type="description">The security descriptor to set. Optional.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.Type"> <summary> <para type="description">The type of object represented by Name. Default to File.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.ShowProgress"> <summary> <para type="description">Specify to show the progress when setting security.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.KeepExplicit"> <summary> <para type="description">Specify to keep explicit ACEs.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.PassThru"> <summary> <para type="description">Specify to pass through results of the security setting operation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.ErrorOnly"> <summary> <para type="description">Specify to only show progress/pass through when an error occurs.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.ResetWin32SecurityDescriptorCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet"> <summary> <para type="synopsis">Search for inherited ACLs for the security descriptor.</para> <para type="description">This cmdlet searches for the ancestors of an inherited security resource. </para> </summary> <example> <code>Search-Win32SecurityDescriptor "c:\test"</code> <para>Search for the inheritance ancestors of c:\test.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.Name"> <summary> <para type="description">The name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.SecurityDescriptor"> <summary> <para type="description">The security descriptor to check for inheritance.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.GenericMapping"> <summary> <para type="description">Specify the GenericMapping for the check.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.Sacl"> <summary> <para type="description">Specify to check the SACL. Default is the DACL.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.Type"> <summary> <para type="description">The type of object represented by Name. Default is File.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.ObjectType"> <summary> <para type="description">Specify list of object types.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.QuerySecurity"> <summary> <para type="description">Specify to query the full security descriptor for the ancestors.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.SearchWin32SecurityDescriptorCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet"> <summary> <para type="synopsis">Sets a security descriptor using the Win32 APIs.</para> <para type="description">This cmdlet sets the security descriptor on an object using the Win32 SetSecurityInfo APIs. </para> </summary> <example> <code>Set-Win32SecurityDescriptor "c:\test" $sd Dacl</code> <para>Set the DACL of the file path c:\test.</para> </example> <example> <code>Set-Win32SecurityDescriptor -Object $obj -Type Kernel $sd Dacl</code> <para>Set the DACL of a kernel object.</para> </example> <example> <code>Set-Win32SecurityDescriptor -Handle -Type Kernel $handle $sd Dacl</code> <para>Set the DACL of a kernel object handle.</para> </example> <example> <code>Set-Win32SecurityDescriptor "c:\test" $sd Dacl -ShowProgress</code> <para>Set the DACL of the file path c:\test and show progress</para> </example> <example> <code>Set-Win32SecurityDescriptor "c:\test" $sd Dacl -ShowProgress</code> <para>Set the DACL of the file path c:\test and show progress</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.Name"> <summary> <para type="description">The name of the object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.Object"> <summary> <para type="description">Handle to an object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.Handle"> <summary> <para type="description">Handle to an object.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.Type"> <summary> <para type="description">The type of object represented by Name/Object/Handle. Default is File.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.SecurityDescriptor"> <summary> <para type="description">The security descriptor to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.SecurityInformation"> <summary> <para type="description">Specify the security information to set.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.ShowProgress"> <summary> <para type="description">Specify to show the progress when setting security.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.PassThru"> <summary> <para type="description">Specify to pass through results of the security setting operation.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.Action"> <summary> <para type="description">Specify to the tree operation to perform.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.ErrorOnly"> <summary> <para type="description">Specify to only show progress/pass through when an error occurs.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.ProcessRecord"> <summary> Process Record. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.SetWin32SecurityDescriptorCmdlet.#ctor"> <summary> Constructor. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.Win32ErrorResult"> <summary> The result of an WIN32 error code lookup. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32ErrorResult.ErrorCode"> <summary> The numeric value of the error code. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32ErrorResult.Name"> <summary> The name of the error code if known. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32ErrorResult.Message"> <summary> Corresponding message text. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Win32.Win32SetSecurityDescriptorResult"> <summary> <para type="description">Result object for setting a security descriptor.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32SetSecurityDescriptorResult.Name"> <summary> The name of the resource which was set. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32SetSecurityDescriptorResult.Error"> <summary> The error during the operation. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.Win32SetSecurityDescriptorResult.SecuritySet"> <summary> Whether security was set. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.Win32SetSecurityDescriptorResult.#ctor(System.String,NtApiDotNet.Win32.Win32Error,System.Boolean)"> <summary> Constructor. </summary> <param name="name">The name of the resource which was set.</param> <param name="error">The error during the operation.</param> <param name="security_set">Whether security was set.</param> </member> <member name="T:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet"> <summary> <para type="synopsis">Create a DOS device symlink.</para> <para type="description">This cmdlet creates or redefines a DOS device symlink. This symlink will be permanent, until it's deleted rather than requiring a handle to be maintained.</para> </summary> <example> <code>Add-DosDevice Z: C:\Windows</code> <para>Define a Z: drive which points to C:\Windows.</para> </example> <example> <code>Add-DosDevice Z: \Device\HarddiskVolume1\windows -RawTargetPath</code> <para>Define a Z: drive which points to Windows using a raw target path.</para> </example> <example> <code>Add-DosDevice "\RPC Control\ABC" c:\Windows</code> <para>Define the symlink '\RPC Control\ABC' drive which points to c:\Windows.</para> </example> <example> <code>Add-DosDevice Z: C:\Windows -NoBroadcastSystem</code> <para>Define a Z: drive which points to C:\Windows but don't broadcast the changes to applications on the desktop.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet.DeviceName"> <summary> <para type="description">The device name to create. If this string starts with a \ then the symlink will be created relative to the root of the object manager.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet.TargetPath"> <summary> <para type="description">Specify the target path. This should be a DOS path, unless RawTargetPath is set then it can be arbitrary object manager path.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet.NoBroadcastSystem"> <summary> <para type="description">Don't broadcast the change to the desktop using WM_SETTINGCHANGE.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet.RawTargetPath"> <summary> <para type="description">Specify the TargetPath as a raw object manager path.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Win32.AddDosDeviceCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.CompareRpcServerCmdlet"> <summary> <para type="synopsis">Compare two lists of RPC server objects for differences.</para> <para type="description">This cmdlet compares two lists of RPC server objects for differences. It highlights servers which didn't exist before as well as servers which have been modified in some way.</para> </summary> <example> <code>Compare-RpcServer -Server $new -CompareServer $old</code> <para>Compare a list of old servers in $old with ones in $new.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerCmdlet.Server"> <summary> <para type="description">Specify a list of RPC servers for comparison.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerCmdlet.CompareServer"> <summary> <para type="description">Specify a list of RPC servers to compare against Server.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Rpc.CompareRpcServerCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.CompareRpcServerResult"> <summary> <para type="description">Result of a RPC server comparison.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerResult.AddedServer"> <summary> Collection of added servers in comparison. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerResult.ModifiedServer"> <summary> Collection of modified servers in comparison. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerResult.AddedServerCount"> <summary> Count of added servers. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.CompareRpcServerResult.ModifiedServerCount"> <summary> Count of modified servers. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet"> <summary> <para type="synopsis">Selects RPC server objects based on some specific criteria.</para> <para type="description">This cmdlet selects out RPC servers from a list based on a few specific criteria such as partial name match or specific parameter types.</para> </summary> <example> <code>$rpc | Select-RpcServer -Name "Start"</code> <para>Select all servers which have a procedure containing the text Start.</para> </example> <example> <code>$rpc | Select-RpcServer -SystemHandle</code> <para>Select all servers which have a procedure which take a system handle parameter.</para> </example> <example> <code>$rpc | Select-RpcServer -SystemHandle -SystemHandleType File</code> <para>Select all servers which have a procedure which take a system handle parameter of type File.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.Server"> <summary> <para type="description">Specify a list of RPC servers for selecting.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.Name"> <summary> <para type="description">Specify name to partially match against a function name.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.SystemHandle"> <summary> <para type="description">Specify one function must take a system handle parameter.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.SystemHandleType"> <summary> <para type="description">Specify an optional type of system handle to match.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.InterfaceId"> <summary> <para type="description">Specify the Interface ID to match.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.InterfaceVersion"> <summary> <para type="description">Specify an optional interface version to match.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Rpc.SelectRpcServerCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord method. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.ModifiedRpcServerResult"> <summary> Result of a modified RPC server. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.ModifiedRpcServerResult.Server"> <summary> The server which was modified. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.ModifiedRpcServerResult.CompareServer"> <summary> The original compare server. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.ModifiedRpcServerResult.AddedProcedure"> <summary> A collection of added procedures. </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.ModifiedRpcServerResult.AddedProcedureCount"> <summary> The count of added procedures. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.GetRpcServerName"> <summary> <para type="synopsis">Get the names from a RPC server as XML.</para> <para type="description">This cmdlet extracts the names from a RPC server instance and generates an XML file for easy editing. You can then update the names with Set-RpcServerName.</para> </summary> <example> <code>Get-RpcServerName -Server $server</code> <para>Get names for an RPC server object.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.GetRpcServerName.Server"> <summary> <para type="description">Specify the server object to get the names from.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Rpc.GetRpcServerName.ProcessRecord"> <summary> Process record override. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Rpc.SetRpcServerName"> <summary> <para type="synopsis">Set the names of a RPC server from XML.</para> <para type="description">This cmdlet extracts updates the names for a RPC server instance from XML data. You can get the names with Get-RpcServerName.</para> </summary> <example> <code>Set-RpcServerName -Server $server -Names $xml</code> <para>Set names for an RPC server object from a string.</para> </example> <example> <code>Get-Content names.xml | Set-RpcServerName -Server $server</code> <para>Set names for an RPC server object from a file.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SetRpcServerName.Server"> <summary> <para type="description">Specify the server object to update the names on.</para> </summary> </member> <member name="P:NtObjectManager.Cmdlets.Rpc.SetRpcServerName.Xml"> <summary> <para type="description">Specify the XML data which contains the names to update.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Rpc.SetRpcServerName.ProcessRecord"> <summary> Process record override. </summary> </member> <member name="M:NtObjectManager.Cmdlets.Rpc.SetRpcServerName.EndProcessing"> <summary> End processing override. </summary> </member> <member name="T:NtObjectManager.Cmdlets.Utils.GetRandomByteCmdlet"> <summary> <para type="synopsis">Get a random byte array.</para> <para type="description">This cmdlet returns a byte array containing random bytes up to a fixed size.</para> </summary> <example> <code>$ba = Get-RandomByte -Size 100</code> <para>Get a random byte array of length 100.</para> </example> </member> <member name="P:NtObjectManager.Cmdlets.Utils.GetRandomByteCmdlet.Size"> <summary> <para type="description">The size of the random byte array.</para> </summary> </member> <member name="M:NtObjectManager.Cmdlets.Utils.GetRandomByteCmdlet.ProcessRecord"> <summary> Overridden ProcessRecord. </summary> </member> <member name="T:NtObjectManager.Utils.ChannelBindingHolder"> <summary> Class to hold a channel binding value. </summary> </member> <member name="M:NtObjectManager.Utils.ChannelBindingHolder.op_Explicit(NtObjectManager.Utils.ChannelBindingHolder)~NtApiDotNet.Win32.Security.Authentication.SecurityChannelBinding"> <summary> Cast the holder to a SecurityChannelBinding </summary> <param name="holder">The holder.</param> </member> <member name="M:NtObjectManager.Utils.ChannelBindingHolder.#ctor(NtApiDotNet.Win32.Security.Authentication.SecurityChannelBinding)"> <summary> Constructor. </summary> <param name="value">The channel binding application data.</param> </member> <member name="M:NtObjectManager.Utils.ChannelBindingHolder.#ctor(System.Byte[])"> <summary> Constructor. </summary> <param name="value">The channel binding application data.</param> </member> <member name="M:NtObjectManager.Utils.ChannelBindingHolder.#ctor(System.Object[])"> <summary> Constructor. </summary> <param name="value">The channel binding application data.</param> </member> <member name="T:NtObjectManager.Utils.Firewall.FirewallCalloutGuid"> <summary> Firewall callout GUID. </summary> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallCalloutGuid.#ctor(System.String)"> <summary> Constructor. </summary> <param name="name">Name of the callout or a GUID</param> </member> <member name="T:NtObjectManager.Utils.Firewall.FirewallLayerGuid"> <summary> Firewall layer GUID. </summary> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallLayerGuid.#ctor(System.String)"> <summary> Constructor. </summary> <param name="name">Name of the layer or a GUID</param> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallLayerGuid.#ctor(NtApiDotNet.Net.Firewall.FirewallAleLayer)"> <summary> Constructor. </summary> <param name="ale_layer">The pre-defined ALE layer.</param> </member> <member name="T:NtObjectManager.Utils.Firewall.FirewallObjectGuid"> <summary> Utility class to convert a name to a GUID. </summary> </member> <member name="P:NtObjectManager.Utils.Firewall.FirewallObjectGuid.Id"> <summary> Guid for object.. </summary> </member> <member name="T:NtObjectManager.Utils.Firewall.FirewallPackageSid"> <summary> Helper class to get a firewall package SID. </summary> </member> <member name="P:NtObjectManager.Utils.Firewall.FirewallPackageSid.Sid"> <summary> The package SID. </summary> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallPackageSid.#ctor(System.String)"> <summary> Constructor. </summary> <param name="sid">The SID in SDDL format or a package name.</param> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallPackageSid.#ctor(NtApiDotNet.NtToken)"> <summary> Constructor. </summary> <param name="token">The token to extract the package SID from.</param> </member> <member name="T:NtObjectManager.Utils.Firewall.FirewallSubLayerGuid"> <summary> Firewall sublayer GUID. </summary> </member> <member name="M:NtObjectManager.Utils.Firewall.FirewallSubLayerGuid.#ctor(System.String)"> <summary> Constructor. </summary> <param name="name">Name of the sub-layer or a GUID</param> </member> <member name="T:NtObjectManager.Utils.Kerberos.PSKerberosKDCProxy"> <summary> Class to implement a KDC proxy using PowerShell. </summary> </member> <member name="M:NtObjectManager.Utils.Kerberos.PSKerberosKDCProxy.#ctor(NtApiDotNet.Win32.Security.Authentication.Kerberos.Server.IKerberosKDCServerListener,NtApiDotNet.Win32.Security.Authentication.Kerberos.Client.IKerberosKDCClientTransport,System.Management.Automation.ScriptBlock,System.Management.Automation.ScriptBlock,System.Management.Automation.ScriptBlock)"> <summary> Constructor. </summary> <param name="listener">Server listener.</param> <param name="client_transport">Client transport.</param> <param name="handle_request">Script block to handle the request.</param> <param name="handle_reply">Script block to handle the reply.</param> <param name="handle_error">Script block to handle an error.</param> </member> <member name="M:NtObjectManager.Utils.Kerberos.PSKerberosKDCProxy.HandleRequest(System.Byte[])"> <summary> Handle a request. </summary> <param name="request">The request to handle.</param> <returns>The reply.</returns> </member> <member name="T:NtObjectManager.Utils.PasswordHolder"> <summary> <para type="description">Class to hold a password from the user.</para> </summary> </member> <member name="P:NtObjectManager.Utils.PasswordHolder.Password"> <summary> Get the password as a secure string. </summary> </member> <member name="M:NtObjectManager.Utils.PasswordHolder.#ctor(System.Security.SecureString)"> <summary> Constructor. </summary> <param name="str">The secure string password.</param> </member> <member name="M:NtObjectManager.Utils.PasswordHolder.#ctor(System.String)"> <summary> Constructor. </summary> <param name="str">The string password.</param> </member> <member name="M:NtObjectManager.Utils.PasswordHolder.ToPlainText"> <summary> Convert the secure string to plain text. </summary> <returns></returns> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskState"> <summary> State of the running task. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.RunningScheduledTaskEntry"> <summary> <para type="description">Class to represent a running scheduled task.</para> </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.RunningScheduledTaskEntry.ProcessId"> <summary> Process ID of the instance. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.RunningScheduledTaskEntry.InstanceId"> <summary> The GUID ID. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.RunningScheduledTaskEntry.State"> <summary> The state of the task. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.RunningScheduledTaskEntry.CurrentAction"> <summary> The current action. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction"> <summary> Class to represent a scheduled task action. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction.Id"> <summary> The ID of the action. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction.ActionType"> <summary> Type of action. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction.Action"> <summary> Summary of what will be invoked. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction.HasArguments"> <summary> Indicates if this action takes arguments. </summary> </member> <member name="M:NtObjectManager.Utils.ScheduledTask.ScheduledTaskAction.ToString"> <summary> Overridden ToString. </summary> <returns>The action as a string.</returns> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry"> <summary> Schedled task entry. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Path"> <summary> The path to the scheduled task. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Folder"> <summary> Is this entry a folder. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.SecurityDescriptor"> <summary> The scheduled task security descriptor. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Enabled"> <summary> Is the task enabled. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Hidden"> <summary> Is the task hidden. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.AllowDemandStart"> <summary> Can the task be run on demand. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Xml"> <summary> The XML task file. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.LogonType"> <summary> Principal logon type. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.RunLevel"> <summary> Principal run level. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Principal"> <summary> Principal name. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Actions"> <summary> Actions for the task. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.RequiredPrivilege"> <summary> List of required privileges. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.ProcessTokenSid"> <summary> Principal process token SID. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.Triggers"> <summary> Triggers for the task. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskEntry.HasActionArguments"> <summary> Indicates whether the task has action arguments. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTriggerType"> <summary> Type of scheduled task trigger. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger"> <summary> Class for a scheduled task trigger. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger.Id"> <summary> The ID of the trigger. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger.TriggerType"> <summary> The type of the trigger. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger.StartBoundary"> <summary> The start boundary for the trigger. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger.EndBoundary"> <summary> The end boundary for the trigger. </summary> </member> <member name="P:NtObjectManager.Utils.ScheduledTask.ScheduledTaskTrigger.ExecutionTimeLimit"> <summary> Time limit for execution. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskActionType"> <summary> The type of action the task performs when run. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskActionType.None"> <summary> None or unknown. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskActionType.Execute"> <summary> Execute a process. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskActionType.ComObject"> <summary> Load a COM object. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskActionType.SendEmail"> <summary> Send an email. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskActionType.ShowMessage"> <summary> Show a message. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskLogonType"> <summary> The type of logon used for the task. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskLogonType.None"> <summary> No logon type. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskLogonType.Group"> <summary> Group activation. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskLogonType.User"> <summary> User activation. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskLogonType.S4U"> <summary> Uses Services for User. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskLogonType.ServiceAccount"> <summary> Service account. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskProcessTokenSid"> <summary> Task process token SID type. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskProcessTokenSid.None"> <summary> None. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskProcessTokenSid.Unrestricted"> <summary> Unrestricted task SID. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskProcessTokenSid.Default"> <summary> Default task SID. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskRunFlags"> <summary> Flags for running a task. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunFlags.None"> <summary> None </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunFlags.AsSelf"> <summary> Run as user calling Run. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunFlags.IgnoreConstrains"> <summary> Ignore task constraints. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunFlags.UseSessionId"> <summary> Use the session ID for the terminal session. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunFlags.UserSid"> <summary> Run using a SID. </summary> </member> <member name="T:NtObjectManager.Utils.ScheduledTask.TaskRunLevel"> <summary> The task run level to use. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunLevel.Limited"> <summary> Normal limited user. </summary> </member> <member name="F:NtObjectManager.Utils.ScheduledTask.TaskRunLevel.Highest"> <summary> Highed run level available. </summary> </member> <member name="T:NtObjectManager.Utils.CoreCSharpCodeProvider"> <summary> Simple class to implement the C# compiler on Core using the in-built .NET Framework. </summary> /// <remarks>This class only implements enough functionality to get RpcClientBuilder working. You need .NET 4 installed.</remarks> </member> <member name="P:NtObjectManager.Utils.CoreCSharpCodeProvider.IsSupported"> <summary> Get whether there's a supported compiler. </summary> </member> <member name="M:NtObjectManager.Utils.CoreCSharpCodeProvider.CompileAssemblyFromDom(System.CodeDom.Compiler.CompilerParameters,System.CodeDom.CodeCompileUnit[])"> <summary> Compile an assembly from DOM. </summary> <param name="options">Compiler options.</param> <param name="compilationUnits">Compilation units to compile.</param> <returns>The compiler results.</returns> </member> <member name="T:NtObjectManager.Utils.TextEncodingType"> <para type="description">Enumeration to specify a text encoding.</para> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.Binary"> <summary> Binary raw text. </summary> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.Unicode"> <summary> 16 bit unicode text. </summary> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.BigEndianUnicode"> <summary> Big Endian 16 bit unicode text. </summary> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.UTF8"> <summary> UTF8 </summary> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.UTF32"> <summary> UTF32 </summary> </member> <member name="F:NtObjectManager.Utils.TextEncodingType.UTF7"> <summary> UTF7 </summary> </member> <member name="T:NtObjectManager.Utils.PSUtils"> <summary> Some utility functions for PowerShell. </summary> </member> <member name="M:NtObjectManager.Utils.PSUtils.ResolveWin32Path(System.Management.Automation.SessionState,System.String)"> <summary> Resolve a Win32 path using current PS session state. </summary> <param name="state">The session state.</param> <param name="path">The path to resolve.</param> <returns>The resolved Win32 path.</returns> </member> <member name="M:NtObjectManager.Utils.PSUtils.GetFsVolumeInfoClass"> <summary> Get list of volume info classes. </summary> <returns>The volume information classes.</returns> </member> <member name="M:NtObjectManager.Utils.PSUtils.GetSigningLevel(System.String)"> <summary> Get the signing level for an image file. </summary> <param name="path">The path to the image file.</param> <returns>The signing level.</returns> </member> <member name="T:NtObjectManager.Provider.NtKeyEntry"> <summary> A class representing a NT key entry. </summary> </member> <member name="M:NtObjectManager.Provider.NtKeyEntry.ToObject(System.Boolean)"> <summary> Try and open the directory entry and return an actual NtObject handle. </summary> <param name="throw_on_error">True to throw on error.</param> <returns>The object opened.</returns> <exception cref="T:System.ArgumentException">Thrown if invalid typename.</exception> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.Values"> <summary> Get the key's values. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.ValueNames"> <summary> Get names of the values. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.ValueCount"> <summary> Get the number of values in the key. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.Item(System.String)"> <summary> Get a key by name. </summary> <param name="name">The name of the key.</param> <returns>Returns the key if found or null.</returns> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.DefaultValue"> <summary> Get the default value for the key. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.ControlFlags"> <summary> Get Key Control Flags. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.ClassName"> <summary> Get key class name. </summary> </member> <member name="P:NtObjectManager.Provider.NtKeyEntry.VirtualizationFlags"> <summary> Get Key Virtualization Flags. </summary> </member> <member name="T:NtObjectManager.Provider.GenericObjectSecurity"> <summary> Generic object security which takes an integer access mask. </summary> </member> <member name="M:NtObjectManager.Provider.GenericObjectSecurity.#ctor"> <summary> Constructor </summary> </member> <member name="M:NtObjectManager.Provider.GenericObjectSecurity.#ctor(NtApiDotNet.NtObject,System.Security.AccessControl.AccessControlSections)"> <summary> Constructor taking security descriptor from an object. </summary> <param name="obj">The NT object to extract the security descriptor from.</param> <param name="include_sections">Indicates which bits of the security descriptor you want to include.</param> </member> <member name="T:NtObjectManager.Provider.NtDirectoryEntry"> <summary> A class representing a NT object manager directory entry. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.Name"> <summary> Get the name of the entry. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.TypeName"> <summary> Get the NT type name of the entry. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.IsDirectory"> <summary> Indicates if this entry is a directory. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.IsDevice"> <summary> Indicates if this entry is a Device. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.IsSymbolicLink"> <summary> Indicates if this entry is a symbolic link. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.RelativePath"> <summary> The relative path from the drive base to the entry. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.SecurityDescriptor"> <summary> The security descriptor of the entry. This can be null if caller does not have permission to open the actual object. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.SymbolicLinkTarget"> <summary> The symbolic link target if IsSymbolicLink is true. Can be null if caller doesn't have permission to open the actual object. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.MaximumGrantedAccess"> <summary> The maximum granted access to the entry. Can be set to 0 if the caller doesn't have permission to open the actual object. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.DeviceType"> <summary> The device type. </summary> </member> <member name="P:NtObjectManager.Provider.NtDirectoryEntry.Characteristics"> <summary> The device characteristics. </summary> </member> <member name="M:NtObjectManager.Provider.NtDirectoryEntry.ToObject(System.Boolean)"> <summary> Try and open the directory entry and return an actual NtObject handle. </summary> <param name="throw_on_error">True to throw on error.</param> <returns>The object opened.</returns> <exception cref="T:System.ArgumentException">Thrown if invalid typename.</exception> </member> <member name="M:NtObjectManager.Provider.NtDirectoryEntry.ToObject"> <summary> Try and open the directory entry and return an actual NtObject handle. </summary> <returns>The object opened.</returns> <exception cref="T:NtApiDotNet.NtException">Thrown if error opening object.</exception> <exception cref="T:System.ArgumentException">Thrown if invalid typename.</exception> </member> <member name="M:NtObjectManager.Provider.NtDirectoryEntry.ToString"> <summary> Overridden ToString method. </summary> <returns>The name of the directory entry.</returns> </member> <member name="T:NtObjectManager.Provider.NtObjectManagerProvider"> <summary> Object manager provider. </summary> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.InitializeDefaultDrives"> <summary> Overridden method to initialize default drives. </summary> <returns>The list of default drives.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.NewDrive(System.Management.Automation.PSDriveInfo)"> <summary> Overridden method to create a new drive. </summary> <param name="drive">The template drive info.</param> <returns>The new drive info.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.RemoveDrive(System.Management.Automation.PSDriveInfo)"> <summary> Overridden method to remove a drive. </summary> <param name="drive">The drive to remove.</param> <returns>The removed drive.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.IsValidPath(System.String)"> <summary> Overridden method to check if path is valid. </summary> <param name="path">The path to check.</param> <returns>True if the path is valid.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.ItemExists(System.String)"> <summary> Overriden method to check if an item exists. </summary> <param name="path">The drive path to check.</param> <returns>True if the item exists.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.IsItemContainer(System.String)"> <summary> Overidden method to check if an item is a container. </summary> <param name="path">The drive path to check.</param> <returns>True if the item is a container.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.GetChildItems(System.String,System.Boolean,System.UInt32)"> <summary> Overridden method to get the child items of a path. </summary> <param name="path">The drive path.</param> <param name="recurse">True if the path should be enumerated recursively.</param> <param name="depth">Depth of the recursion.</param> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.GetChildNames(System.String,System.Management.Automation.ReturnContainers)"> <summary> Overridden method to get the child item names of a path. </summary> <param name="path">The drive path.</param> <param name="returnContainers">Return containers.</param> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.GetItem(System.String)"> <summary> Overridden method to get the item from a path. </summary> <param name="path">The drive path.</param> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.ExpandPath(System.String)"> <summary> Overidden method expand a wildcard in a path. </summary> <param name="path">The drive path with wildcards.</param> <returns>The list of expanded paths.</returns> </member> <member name="M:NtObjectManager.Provider.NtObjectManagerProvider.NewItem(System.String,System.String,System.Object)"> <summary> Overridden method to create a new item. </summary> <param name="path">The drive path to create.</param> <param name="itemTypeName">The NT object type to create.</param> <param name="newItemValue">Additional item value data.</param> </member> </members> </doc> |