IsAdmin from group policy preferences does not account for Item Level Targeting

Open

#37 opened on Dec 24, 2022 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Feature
Clarity: Mostly clear
Activity status: Stale
Tech stack: csharp
Domain: security

Research direction

Start by reviewing the linked Item Level Targeting documentation and the current SharpHound collection of local group membership from GPOs linked to OUs. Done means hostname, OU, and security-group targeting are accounted for when determining local administrators membership; WMI targeting is explicitly out of scope in the issue.

Written by the indexing model from the issue text.

Description

SharpHound does not account for Item Level Targetting when collecting local group membership collection from GPOs linked to OUs,

Group Policy Preference in a GPO can add groups or users into local administrators group only if the host has a matching NETBIOS name or member of an AD group.

I know it will be impossible for SharpHound to account for some item level targeting options such as WMI, but I believe ones that are likely used for managing local groups can, such as hostname, OU and security group membership.

Item level targeting details:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789189(v=ws.11)

Dominant language: C#
Stars: 1.3k
Forks: 266
Avg merge: 2d 7h
Merged PRs (30d): 3

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[quality-improver] Repository Quality: AzureFoundry Extension Missing from Self-Registration Acceptance Test Open

type/automation type/tech-debt

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

microsoft/testfx#11431 · Opened Sep 21, 2026
[Bug]: Composite `ui screenshot` success output ignores `--quiet` Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

microsoft/winappCli#914 · Opened Sep 21, 2026
GeometryHelper.FlattenArc / FlattenCubicBezier / FlattenQuadraticBezier emit a NaN point when the segment count truncates to 0 (0/0) — a Path with a sub-pixel arc fail-fasts Windows with D2DERR_BAD_NUMBER (root cause of #8512, #13757) Open

t/bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

dotnet/maui#38751 · 1 reaction · Opened Sep 21, 2026
[CI Failure] Flaky: MauiBuildQueueTests.CancelQueuedResource_CompletesGracefullyAndDoesNotAcquireSemaphore asserts exact exception type but sometimes gets TaskCanceledException instead of OperationCanceledException Open

ci-failure-cause test-failure

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

microsoft/aspire#20284 · Opened Sep 21, 2026
The login flow's text-link submit is 42 px tall on a narrow screen; its docblock says 44 Open

area:auth FE mvp P3

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

klasolsson81/jobbliggaren#1788 · Opened Sep 21, 2026

More C# issues