Repository navigation
TacSubAuth: refuse a network logon without a SAM record - #3
Merged
Merged
Conversation
Decide() returned STATUS_SUCCESS when MSV1_0 passed no USER_ALL_INFORMATION. Without the record there is no RID, so the filter cannot tell whether the account is enrolled, and "could not tell" must not come out as "no objection" on a network logon. Non-network and pass-through logons keep their usual answer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before: when MSV1_0 called the filter without a
USER_ALL_INFORMATION,Decide()returnedSTATUS_SUCCESSfor every logon, network logons included.After: a network logon to this machine without a SAM record is refused with
STATUS_INVALID_WORKSTATIONand a warning (event 210). Non-network and pass-through logons keep their usual answer.Without the record there is no RID, so the filter cannot tell whether the account is enrolled, and "could not tell" must not come out as "no objection" on the path the filter exists for.
How: one branch at the top of
Decide()and a newVerdict::NoRecord.tests/native/test_lsa.cppnow expects the refusal and checks that interactive and pass-through logons without a record are still allowed.make -C tests/nativepasses.Also in this PR:
actions/checkoutto v5 andupload-artifactto v6, the first versions that run on Node 24.ilammy/msvc-dev-cmd@v1has no Node 24 version yet and still warns.Generated by Claude Code