From 03ceec9d5e89372d21169664dd045d2d3e6cf461 Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Wed, 29 Jul 2026 12:03:31 +0200
Subject: [PATCH] fix(Elysium.Common): dispose DirectoryEntry/ADSI objects

Test-ReplicationPermissions and Test-DCClockSkew each build a
DirectoryEntry (holding a live ADSI/COM binding, with a plaintext
credential) and never call .Dispose(), leaking the underlying COM
resource on every invocation - noticeable across a run that checks
multiple domains/DCs in one session. Added finally blocks to dispose
both.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 Elysium.Common.ps1 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Elysium.Common.ps1 b/Elysium.Common.ps1
index 1294191..cbbb4dc 100644
--- a/Elysium.Common.ps1
+++ b/Elysium.Common.ps1
@@ -400,6 +400,7 @@ function Test-ReplicationPermissions {
         $rightsToCheck = $ncEntry.Value
 
         $acl = $null
+        $de = $null
         try {
             $de = New-Object System.DirectoryServices.DirectoryEntry(
                 "LDAP://$Server/$ncDN",
@@ -411,6 +412,8 @@ function Test-ReplicationPermissions {
         } catch {
             Write-Warning ("Could not read ACL on '$ncDN' for replication permission pre-check: {0}. Skipping." -f $_.Exception.Message)
             continue
+        } finally {
+            if ($de) { $de.Dispose() }
         }
 
         foreach ($rightName in $rightsToCheck.Keys) {
@@ -481,6 +484,7 @@ function Test-DCClockSkew {
         [Parameter(Mandatory)][string]$Server,
         [Parameter(Mandatory)][System.Management.Automation.PSCredential]$Credential
     )
+    $rootDse = $null
     try {
         $rootDse = New-Object System.DirectoryServices.DirectoryEntry(
             "LDAP://$Server/RootDSE",
@@ -502,5 +506,7 @@ function Test-DCClockSkew {
         }
     } catch {
         Write-Warning ("Could not check clock skew against '{0}': {1}" -f $Server, $_.Exception.Message)
+    } finally {
+        if ($rootDse) { $rootDse.Dispose() }
     }
 }