Some interesting PowerShell Modules

NtObjectManager

install-module NtObjectManager -scope currentUser

Test if installation was ok:

new-ntSecurityDescriptor

If not, try

import-module NtObjectManager

Get my SID:

PS:> get-ntSid

Name           Sid
----           ---
XXXNET\renenyf S-1-5-21-1645522239-1844237615-725345543-11593

Get a name from an SID (-ssdl):

PS:> 22 C:/Users/igsnyre/github/prj/IGS> get-ntsid -sddl S-1-5-21-1645522239-1844237615-725345543-11593

Name           Sid
----           ---
XXXNet\renenyf S-1-5-21-1645522239-1844237615-725345543-11593

PS:>  get-ntsid -name administrator

Name                    Sid
----                    ---
COMP10019\Administrator S-1-5-21-1184239113-4185820157-3952089933-500

get-ntStatus

PS:> cd ntObject:\
PS:> get-ntDirectory 'NtObject:\unobtainium'
get-ntDirectory : (0xC000003A) - {Path Not Found}
  ‥
PS:> get-ntStatus 0xC000003A

Status   StatusName                   Message
------   ----------                   -------
C000003A STATUS_OBJECT_PATH_NOT_FOUND {Path Not Found}...

See also James Forshaw: Windows Security Internals (A deep Dive into Windows Authentication, Authorization, and Auditing) and the Github repository tyranid/windows-security-internals.

TODO:

get-ntType lists object types.