search

netwrix / pingcastle

PingCastle - Get Active Directory Security at 80% in 20% of the time
https://www.pingcastle.com
Other
2.35k stars 292 forks source link

HealthCheck XML - DSHeuristics is stored in an unusual way. #197

Closed An-dir closed 1 year ago

An-dir commented 1 year ago

I have noticed something that might not be expected. In environments where DSHeuristics is set, the "//XML/HealthcheckData" directly contains the DSHeuristics

Here is an example:

<?xml version="1.0" encoding="utf-8"?><HealthcheckData xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" DSHeuristics="0000002001001">[...]

This is the only value I have seen that is stored this way. This behavior seems to have been around for at least 1 year.

I guess it should have been stored that way: <?xml version="1.0" encoding="utf-8"?><HealthcheckData xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><EngineVersion>3.1.0.0</EngineVersion><GenerationDate>2023-13-09T09:09:09.0000009+09:00</GenerationDate><Level>Full</Level><MaturityLevel>1</MaturityLevel><DomainFQDN>customer.dom</DomainFQDN><NetBIOSName>customer</NetBIOSName><ForestFQDN>customer.dom</ForestFQDN>[...]<DSHeuristics>0000002001001</DSHeuristics>[...]

vletoux commented 1 year ago

this is because it is defined in the schema as an attribute. https://github.com/vletoux/pingcastle/blob/51412bf7ad13c861d78b95707f762403364af3a8/Data/HealthcheckData.cs#L1401