search

netwrix / pingcastle

PingCastle - Get Active Directory Security at 80% in 20% of the time
https://www.pingcastle.com
Other
2.35k stars 292 forks source link

"Computer Information" of "Domain Controllers" can list member server as Domain Controller #191

Closed An-dir closed 2 months ago

An-dir commented 1 year ago

"Domain Controllers" (in the "Computer Information" section) lists all computer objects in the DomainControllers OU. Normally this is correct, but I have found normal AD member computer objects in this OU. So there were more "DCs" listed than in any other Domain Controller check. So fixing it in this environment is easy - move the object out.

I also had a customer with multiple cluster objects in the "Domain Controllers" OU, because they had an application with cluster feature on DCs. As you can guess the cluster objects all looked like DCs.

Could you optimize that area? Maybe add a column that tells us what DC it is. So it could be "RODC", "RWDC", "ERROR".

vletoux commented 10 months ago

clusters should be filtered now. Can you test with the latest beta available ?

JoeDibley commented 2 months ago

@An-dir, I have added an item to the backlog to add IsReadOnly and IsGlobalCatalog to the Domain Controllers table to make it clearer. When then corresponding attributes are not set we will use "Unknown" which should clearly indicate potential issues.

As this has been open for some time with no activity I am going to close this but please do reopen if needed.