Skip to content

Conversation

@Ocmenog
Copy link

@Ocmenog Ocmenog commented Mar 20, 2023

With this PR, the GptTmpl.inf file is parsed more in depth, to extract:

  • MinimumPasswordAge
  • MaximumPasswordAge
  • MinimumPasswordLength
  • PasswordComplexity
  • PasswordHistorySize
  • ClearTextPassword
  • RequiresServerSMBSigning
  • EnablesServerSMBSigning
  • RequiresClientSMBSigning
  • EnablesClientSMBSigning
  • RequiresLDAPClientSigning
  • LmCompatibilityLevel
    If a key is not found, the field is left empty.
    This extension is triggered with the collection method GPOLocalGroup and the changes are visible in the domains.json and the ous.json files.

@github-actions
Copy link

github-actions bot commented Mar 20, 2023

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

@Ocmenog
Copy link
Author

Ocmenog commented Mar 20, 2023

I have read the CLA Document and I hereby sign the CLA

@rvazarkar
Copy link
Contributor

This is pretty cool, we've been talking about pulling more info out of GPOs for a while. Will take a look and discuss internally

@Ocmenog
Copy link
Author

Ocmenog commented May 25, 2023

The extraction of the following lockout policies has been added:

  • LockoutDuration
  • LockoutBadCount
  • ResetLockoutCount
  • ForceLogoffWhenHourExpire

Also, some GPO precedences have been added to visualize the really applied GPO rules:

  • link order (already existing)
  • domain rules applied before the OU ones (already existing)
  • blockInheritance
  • enforced
  • nested OU

Indeed, this PR is related to the BloodHoundAD/BloodHound#672 one, where the main part of the precedences are managed.

@Ocmenog Ocmenog changed the base branch from main to v3 October 24, 2023 12:18
@Ocmenog Ocmenog mentioned this pull request Oct 30, 2023
8 tasks
@Ocmenog
Copy link
Author

Ocmenog commented Oct 30, 2023

The PR has been updated once more to add the extraction of:

  • CachedLogonsCount
  • LDAPEnforceChannelBinding

Moreover, the ingestion and the visualization have been implemented in a new PR for the new BloodHound version.

@StephenHinck
Copy link
Contributor

Hello, please see my comment here: SpecterOps/BloodHound#178 (comment)

@github-actions github-actions bot locked and limited conversation to collaborators Feb 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants