Skip over CAs that can't be resolved to SIDs during collection (#90)

* Skip over CAs that can't be resolved to SIDs during collection * Don't toss entire CA when host SID cannot be resolved, but toss the host
BloodHoundAD · Mar 14, 2024 · 268374f · 268374f
1 parent cc52d72
commit 268374f
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
@@ -638,6 +638,13 @@ private async Task<EnterpriseCA> ProcessEnterpriseCA(ISearchResultEntry entry, R
                 {
                     ret.HostingComputer = await _context.LDAPUtils.ResolveHostToSid(dnsHostName, resolvedSearchResult.Domain);
 
+                    // If ResolveHostToSid does not return a valid SID, we don't want to record this host
+                    if (ret.HostingComputer != null && !ret.HostingComputer.StartsWith("S-1-"))
+                    {
+                        _log.LogWarning("CA host could not be resolved to a SID.", dnsHostName, resolvedSearchResult.Domain);
+                        ret.HostingComputer = null;
+                    }
+
                     CARegistryData cARegistryData = new()
                     {
                         IsUserSpecifiesSanEnabled = _certAbuseProcessor.IsUserSpecifiesSanEnabled(dnsHostName, caName),