TrimarcJake / Locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.
https://github.com/TrimarcJake/Locksmith
Other
768 stars 72 forks source link

Add a check for user's membership in the Protected Users group #86

Closed SamErde closed 6 months ago

SamErde commented 6 months ago

An issue raised in the PSPKIAudit project suggests that ESC8 checks may not work if running the script as a user that is a member of the Protected Users group because NTLM authentication is disabled for them.

This PR adds a function to check if a user is a member of Protected Users (locale-neutral). It has also been contributed to the PSPKI project. 🎁 We should test this function and also check to see if our ESC8 tests are affected by having NTLM authentication disabled for the operator.