-
Notifications
You must be signed in to change notification settings - Fork 47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extraction of password policies and some registry values from the GptTmpl file #52
Conversation
CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅ |
I have read the CLA Document and I hereby sign the CLA |
This is pretty cool, we've been talking about pulling more info out of GPOs for a while. Will take a look and discuss internally |
The extraction of the following lockout policies has been added:
Also, some GPO precedences have been added to visualize the really applied GPO rules:
Indeed, this PR is related to the BloodHoundAD/BloodHound#672 one, where the main part of the precedences are managed. |
The PR has been updated once more to add the extraction of:
Moreover, the ingestion and the visualization have been implemented in a new PR for the new BloodHound version. |
Hello, please see my comment here: SpecterOps/BloodHound#178 (comment) |
With this PR, the GptTmpl.inf file is parsed more in depth, to extract:
If a key is not found, the field is left empty.
This extension is triggered with the collection method GPOLocalGroup and the changes are visible in the domains.json and the ous.json files.