Suggestion: check that LAPS passwords aren't readable

[vletoux]

Suggestion: check that LAPS passwords aren't readable

[vletoux]

I can only check if everyone has "read all extended rights" or "read on ms-mcs-admpwd" and show people having similar rights in the delegation section

[cnotin]

Yes either by analyzing the ACLs, or simply checking if read works...

[vletoux]

You cannot check if read works. Because this is equivalent to know if the user launching pingcastle is part of a local (and delegated) admin group. This is an undecidable problem Le sam. 1 août 2020 à 23:32, Clément Notin <[email protected]> a écrit :

…

Yes either by analyzing the ACLs, or simply checking if read works... — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#50 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACRDZBQKLOP4ZBE2SEQM65LR6SCXTANCNFSM4PQQ5FUQ> .

-- --- Vincent

[cnotin]

Well the LDAP request I suggested above works when the user collecting the data has the rights on some OUs :)

[vletoux]

I've added the read ms-mcs-admpwd to the list of delegations to check

It appears also in the list

This is the maximum I can do, retrieving object with this property set will imply the retrieval of all objects (when running under admin control). This will impact the speed of the report and the info retrieved is hard to interpret

[cnotin]

That's still progress thanks 👍

"retrieving object with this property set will imply the retrieval of all objects (when running under admin control)"
Yes I agree.. And since you can't know if the current user is admin or not, or should have legitimate access to those or not, it's hard to decide!