cqrenet/elysium
5
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Release v2.4.5: detect explicit Deny ACEs in replication permission check

Browse Source 
Test-ReplicationPermissions previously only scanned Allow ACEs, so an
explicit Deny on the DCSync extended rights (common in hardening
baselines that Deny a broad group and Allow only named service
accounts) was invisible to the pre-flight check: it reported
"verified" while Get-ADReplAccount still failed with "Replication
access was denied". The check now flags exactly which right is
blocked and by which identity's Deny ACE.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Tomas Kracmar
2026-07-29 11:49:14 +02:00
parent 1d98b908c6
commit 65e451413e
10 changed files with 52 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Extract-NTHashes.ps1
+1 -1
View File
@@ -7,7 +7,7 @@
##################################################
## Project: Elysium ##
## File: Extract-NTHashes.ps1 ##
## Version: 2.4.4 ##
## Version: 2.4.5 ##
## Support: support@cqre.net ##
##################################################