Release v2.2.2: fix replication permission check for nested groups

Test-ReplicationPermissions now uses the tokenGroups constructed
attribute to resolve all effective SIDs in the caller's Kerberos
token, including nested group memberships. This replaces the
previous MemberOf walk which missed indirect entitlement and
could produce false-positive missing-permission errors.

All versions bumped to unified v2.2.2.

Bump-Version.ps1

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Bump-Version.ps1                       ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

CHANGELOG.md

@@ -6,6 +6,13 @@ Starting with **v2.2.0**, Elysium uses a **unified project version**. All script
 
 ---
 
+## [2.2.2] — 2026-06-09
+
+### Fixed
+- `Test-ReplicationPermissions` (in `Elysium.Common.ps1`) now resolves the caller's **effective token SIDs** via the `tokenGroups` constructed attribute instead of walking `MemberOf` directly. This correctly accounts for nested group memberships and avoids false-positive "missing permissions" errors when the account is entitled through nested groups.
+
+---
+
 ## [2.2.1] — 2026-06-09
 
 ### Changed

Elysium.Common.ps1

@@ -1,4 +1,4 @@
-$script:ElysiumVersion = '2.2.1'
+$script:ElysiumVersion = '2.2.2'
 
 function Invoke-RestartWithExecutable {
     param(
@@ -338,14 +338,20 @@ function Test-ReplicationPermissions {
     try {
         $samName = $Credential.UserName -replace '^.*\\', ''
         $adUser = Get-ADUser -Identity $samName -Server $Server -Credential $Credential `
-            -Properties SID, MemberOf -ErrorAction Stop
+            -Properties SID, DistinguishedName -ErrorAction Stop
         [void]$callerSids.Add($adUser.SID.Value)
-        foreach ($groupDN in @($adUser.MemberOf)) {
+
-            try {
+        # tokenGroups is a constructed attribute containing all SIDs in the user's token,
-                $g = Get-ADGroup -Identity $groupDN -Server $Server -Credential $Credential `
+        # including nested group memberships — more reliable than walking MemberOf recursively
-                    -Properties SID -ErrorAction Stop
+        $userDe = New-Object System.DirectoryServices.DirectoryEntry(
-                [void]$callerSids.Add($g.SID.Value)
+            "LDAP://$Server/$($adUser.DistinguishedName)",
-            } catch { }
+            $Credential.UserName,
+            $Credential.GetNetworkCredential().Password
+        )
+        $userDe.RefreshCache(@('tokenGroups'))
+        foreach ($sidBytes in $userDe.Properties['tokenGroups']) {
+            $sid = New-Object System.Security.Principal.SecurityIdentifier($sidBytes, 0)
+            [void]$callerSids.Add($sid.Value)
         }
     } catch {
         Write-Warning ("Could not resolve account SIDs for replication permission pre-check: {0}. Skipping." -f $_.Exception.Message)

Elysium.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Elysium.ps1                            ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

ElysiumSettings.txt.sample

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: ElysiumSettings.txt                    ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Extract-NTHashes.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Extract-NTHashes.ps1                   ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Prepare-KHDBStorage.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Prepare-KHDBStorage.ps1                ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Test-WeakADPasswords.ps1

@@ -8,7 +8,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Test-WeakADPasswords.ps1               ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Uninstall.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Uninstall.ps1                          ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Update-KHDB.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Update-KHDB.ps1                        ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################
 

Update-LithnetStore.ps1

@@ -7,7 +7,7 @@
 ##################################################
 ## Project: Elysium                             ##
 ## File: Update-LithnetStore.ps1                ##
-## Version: 2.2.1                               ##
+## Version: 2.2.2                               ##
 ## Support: support@cqre.net                    ##
 ##################################################