Skip to content

Commit

Permalink
Fixed some name parsing where we're missing the netbios domain part o…
Browse files Browse the repository at this point in the history
…f it
  • Loading branch information
lkarlslund committed Nov 10, 2023
1 parent 5c785ed commit ae77571
Showing 1 changed file with 13 additions and 5 deletions.
18 changes: 13 additions & 5 deletions modules/integrations/localmachine/analyze/import.go
Original file line number Diff line number Diff line change
Expand Up @@ -521,11 +521,19 @@ func ImportCollectorInfo(ao *engine.Objects, cinfo localmachine.Info) (*engine.O
if service.Account != "" {
nameparts := strings.Split(service.Account, "\\")
// account can be USER, .\USER, DOMAIN\USER (come on!)
if len(nameparts) == 2 && (nameparts[0] == "." || strings.EqualFold(nameparts[0], cinfo.Machine.Domain)) {
svcaccount, _ = ao.FindOrAdd(
engine.DownLevelLogonName, engine.AttributeValueString(cinfo.Machine.Domain+"\\"+nameparts[1]),
)
svcaccount.SetFlex(engine.DataSource, uniquesource)
if len(nameparts) == 2 {
if nameparts[0] == "." || strings.EqualFold(nameparts[0], cinfo.Machine.Domain) {
// .\Name or MACHINE\Name
svcaccount, _ = ao.FindOrAdd(
engine.DownLevelLogonName, engine.AttributeValueString(cinfo.Machine.Domain+"\\"+nameparts[1]),
)
svcaccount.SetFlex(engine.DataSource, uniquesource)
} else {
// DOMAIN\Name
svcaccount, _ = ao.FindOrAdd(
engine.DownLevelLogonName, engine.AttributeValueString(service.Account),
)
}
} else if len(nameparts) == 1 {
// no \\ in name, just a user name!? this COULD be wrong, might be a DOMAIN account?
svcaccount, _ = ao.FindOrAdd(
Expand Down

0 comments on commit ae77571

Please sign in to comment.