SharpHound2 icon indicating copy to clipboard operation
SharpHound2 copied to clipboard

Fix GPO collection collecting versioning GPO when GPA is used

Open Crypt0-M3lon opened this issue 5 years ago • 2 comments

My compagny use Group Policy Admin (https://www.microfocus.com/en-us/products/netiq-group-policy-administrator/overview) to manage GPO. When collecting GPO, versionned GPO managed by GPA are collected, leading the the collect of 4 Default Domain Policy and wrong/false positive attack paths. The main différence between a versionned GPO and an GPO is the presence of the Flags attributes in the Group Policy Object. The patch just add a check for the flags attribute existence in LDAP queries to ignore versionned GPO.

Crypt0-M3lon avatar Apr 02 '19 09:04 Crypt0-M3lon

Interesting, I dont think I've run into this before, going to take a look and make sure everything works properly before merging

rvazarkar avatar Apr 08 '19 16:04 rvazarkar

Yep sure, ping me on slack if you need further information.

Crypt0-M3lon avatar Apr 08 '19 20:04 Crypt0-M3lon