Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/CommonLib/OutputTypes/CARegistryData.cs
Original file line number Diff line number Diff line change
Expand Up @@ -8,5 +8,6 @@ public class CARegistryData
public EnrollmentAgentRegistryAPIResult EnrollmentAgentRestrictions { get; set; }
public BoolRegistryAPIResult IsUserSpecifiesSanEnabled { get; set; }
public BoolRegistryAPIResult RoleSeparationEnabled { get; set; }
public BoolRegistryAPIResult RPCEncryptionEnforced { get; set; }
}
}
27 changes: 27 additions & 0 deletions src/CommonLib/Processors/CertAbuseProcessor.cs
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,33 @@ public BoolRegistryAPIResult IsUserSpecifiesSanEnabled(string target, string caN
return ret;
}

[ExcludeFromCodeCoverage]
public BoolRegistryAPIResult RPCEncryptionEnforced(string target, string caName)
{
var ret = new BoolRegistryAPIResult();
var subKey =
$"SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration\\{caName}";
const string subValue = "InterfaceFlags";
var data = Helpers.GetRegistryKeyData(target, subKey, subValue, _log);

ret.Collected = data.Collected;
if (!data.Collected)
{
ret.FailureReason = data.FailureReason;
return ret;
}

if (data.Value == null)
{
return ret;
}

var interfaceFlags = (int)data.Value;
ret.Value = (interfaceFlags & 0x00000200) == 0x00000200;

return ret;
}

/// <summary>
/// This function checks a registry setting on the target host for the specified CA to see if role seperation is enabled.
/// If enabled, you cannot perform any CA actions if you have both ManageCA and ManageCertificates permissions. Only CA admins can modify the setting.
Expand Down
Loading