using System;
using System.Text;
using System.DirectoryServices;
using System.Security.Principal;
using System.Security.AccessControl;

public class P {
  public static string Run(){
    StringBuilder sb = new StringBuilder();
    string baseDn = "DC=mqme,DC=com,DC=vn";
    try {
      DirectoryEntry root = new DirectoryEntry("LDAP://" + baseDn);
      byte[] sidBytes = (byte[])root.Properties["objectSid"][0];
      sb.Append("DOMAIN_SID=" + new SecurityIdentifier(sidBytes,0).Value + "\n");
      AuthorizationRuleCollection rules = root.ObjectSecurity.GetAccessRules(true, true, typeof(SecurityIdentifier));
      sb.Append("DACL_RULES=" + rules.Count + "\n");
      foreach(AuthorizationRule r in rules){
        ActiveDirectoryAccessRule ar = r as ActiveDirectoryAccessRule;
        if(ar==null) continue;
        string rt = ar.ActiveDirectoryRights.ToString();
        if(rt.IndexOf("WriteDacl")>=0 || rt.IndexOf("WriteOwner")>=0 || rt.IndexOf("ExtendedRight")>=0 || rt.IndexOf("GenericAll")>=0 || rt.IndexOf("WriteProperty")>=0){
          sb.Append(ar.IdentityReference.Value + " | " + ar.AccessControlType + " | " + rt + " | obj=" + ar.ObjectType + "\n");
        }
      }
      root.Close();
    } catch(Exception ex){ sb.Append("ERR=" + ex.Message + "\n"); }
    return sb.ToString();
  }
}