Refactor Get-BTDanglingSPN to fix bugs and make it zoom

TrimarcJake / BlueTuxedo

A tiny tool to find and fix common misconfigurations in Active Directory-integrated DNS

Other

99 stars 7 forks source link

Refactor Get-BTDanglingSPN to fix bugs and make it zoom #28

Closed SamErde closed 2 months ago

SamErde commented 4 months ago

All of the updates. ☕

Refactored to eliminate redundant DNS checks and rely on a cached copy of DNS records.
Added a separate check to resolve FQDNs in external/excluded domains.
Using more gatekeeping if blocks to reduce length of checks for each principal and SPN.
Fixed bug that included SPNs with port numbers (eg: SQL) as hostnames.
Added comment-based help because it's awesome.
Clarified property names in the DanglingSPN output.

TrimarcJake commented 2 months ago

ZOOM is right! Nice work!

TrimarcJake commented 2 months ago

Ope, I was so impressed by the speed that I forgot to notice you're leaving SPNs on DCs in the list i.e. ldap/3bffb92d-4949-47f1-b861-e24f1414a63a._msdcs.BlueTuxedo.DanglingSPNs.lol is not a dangling SPN.

In the original Get-BTDanglingSPN, I filtered out SPNs on DCs that had a GUID in the host portion. Seemed to work well enough. Enhancement?

SamErde commented 2 months ago

Thanks! Thought I kept that DC check in but I'll review my history to see where it went.

SamErde commented 2 months ago

Have been AFK all day but checked on my phone. Your GUID check is still in there but obviously I did something to nerf it. Will figure it out!