-
Notifications
You must be signed in to change notification settings - Fork 47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixed LAPS attributes #167
Conversation
Updated LAPS password attributes
Updated logic to create ReadLAPSPassword edges based on updated LAPS password attributes
Updated logic to pull GUIDs for new LAPS password attributes
Corrected new LAPS password expiry attribute
Looks like there is another issue with building the GUID cache. I'm getting a handful of these errors in my lab when running SharpHound with That effects legacy LAPS too. Will get that fixed first and then test your PR. |
Think I have worked out the confusion. The HasLAPS() logic seems to be not returning the value for the name attribute Whereas, the BuildGuidCache is returning the SchemaIDGuid and the name values for the LAPS extended rights. So I have fixed the attributes in "new" LAPS. @JonasBK / @rvazarkar can I just get you confirm the name values are correct for the legacy LAPS. LegacyLAPSExpirationTime = value of adminDisplayName / cn / lDAPDisplayName (assumings it different value to name) for LegacyLAPSPassword = value of name for |
Will test legacy LAPS later and if all good, will merge in. Thank you for the excellent work! |
Description
As discussed with @rvazarkar attributes for "new" LAPS were not being captured due to typos
Motivation and Context
ReadLAPSPassword edges were not being created as the password attributes were not captured in the GUID map
How Has This Been Tested?
This has not been tested, just sanity checked by matching up the names in the AD schema
Screenshots (if appropriate):
Example of the ms-LAPS-EncryptedPassword GUID
Types of changes
Checklist: