v1.4.0 - Public Release

🔐 v1.4-prod — Security Warnings, Least-Privilege Templates & Documentation Overhaul

Summary

v1.4 adds a context-aware security warning system that checks every delegation against a curated risk database before applying, enforces least-privilege across all shipped templates, and brings 17 new granular user delegation templates.

Highlights

🛡️ Security Warning System (new)

• New security/security-reference.json — curated database of 255 AD attributes and extended rights with risk levels, attack techniques, known tools, and reference URLs
• Context-aware matching via appliesTo — warnings adapt to the target object type (user, group, computer, GPO, …)
• Interactive [Y/N] confirmation prompt before applying high-risk delegations
• New parameters: -WarnSeverity (threshold: Critical/High/Medium/Low, default Medium), -DisableSecurityWarning (for CI/automation)

🔒 Least-Privilege Enforcement

• GenericAll removed from templates 100, 200, 300, 600, 700 — replaced with granular rights (ReadProperty, WriteProperty, Delete, specific ExtendedRights)
• WriteProperty @ (all properties) replaced with specific attributes where applicable (e.g. computer rename: cn, name, distinguishedName)
• Fixed 4 incorrect attribute/right mappings (wrong password attribute, wrong display name attribute, Change vs. Reset Password, userPassword vs. pwdLastSet)

📦 17 New User Templates (IDs 111–152)

• Granular single-attribute templates: first name, last name, email, mobile, job title, department, company, manager, address, profile photo, notes, home directory
• Security-focused: Kerberos encryption types, constrained delegation, RBCD, validated SPN writes
• Read-only diagnostics: lockout info, last logon, password status

📐 Template Structure Improvements

• Category field added to all 95 templates — enables grouped -ShowTemplates output (Object Type → Category)
• ObjectClass field for explicit display grouping in -ShowTemplates
• All descriptions verb-normalized (Create, Read, Modify, Delete, …)
• IDs renumbered consecutively within category ranges
• Combined rights split into separate rules (one right per rule)

📄 Documentation

• Main README rewritten — concise, IT-professional style, security feature prominently placed
• templates/README.md rewritten — accurate JSON schema with all fields, real examples from template files
• security/README.md created — schema documentation, statistics, risk levels, usage guide
• CHANGELOG.md — comprehensive change log covering every template and script change

Breaking Changes

Change	Impact	Migration
GenericAll → granular rights	Templates 100, 200, 300, 600, 700 no longer grant full control	Create custom templates if you need GenericAll
Template ID renumbering	User 100–152, Group 200–214, Computer 300–312	Run -ShowTemplates to verify IDs; check CHANGELOG for mapping
Interactive security prompt	Script blocks on [Y/N] for high-risk delegations	Pass -DisableSecurityWarning for non-interactive use
Category field required	Templates without Category appear as "Uncategorized"	Add "Category": "..." to custom templates

Files Changed

Path	Change
Invoke-ADDelegationTemplate.ps1	Security warning system, -WarnSeverity/-DisableSecurityWarning params, grouped -ShowTemplates, Category/ObjectClass support
security/security-reference.json	New — 255 risk references with context-aware appliesTo
security/README.md	New — Schema docs, statistics, usage guide
templates/100-user.json	17 new templates, least-privilege fixes, verb normalization, ID renumbering
templates/200-group.json	GenericAll → granular, distinguishedName fix, SCOPE normalization
templates/300-computer.json	WriteProperty @ → granular attributes, split combined rights
templates/400-organizationalUnit.json	distinguishedName consistency fix
templates/500-groupPolicy.json	Category field added
templates/600-wmi.json	GenericAll → granular
templates/700-inetOrgPerson.json	GenericAll → granular
templates/README.md	Rewritten — accurate schema, ObjectClass field, categories per file
README.md	Rewritten — concise, security-first layout
CHANGELOG.md	Full v1.4 change documentation

What's Changed

• V1.4 dev by @janweis in #7

Full Changelog: v1.3.0...v1.4.0