Prepare for release 6.4

MichaelGrafnetter · MichaelGrafnetter · commit d423660a4418 · 2026-03-28T10:58:48.000-07:00
diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
@@ -0,0 +1 @@
+@../AGENTS.md
diff --git a/.claude/skills/code-review/SKILL.md b/.claude/skills/code-review/SKILL.md
@@ -1,6 +1,5 @@
 ---
-agent: agent
-tools: ['edit/editFiles', 'search/codebase', 'search/readFile', 'problems', 'changes', 'runTests']
+name: code-review
 description: 'Perform a systematic code review of all source files, focusing on security, performance, backwards compatibility, and design principles.'
 ---
 
diff --git a/.claude/skills/doc-comments/SKILL.md b/.claude/skills/doc-comments/SKILL.md
@@ -1,12 +1,11 @@
 ---
-agent: agent
-tools: ['edit/editFiles', 'search/readFile', 'search/codebase', 'problems', 'changes']
+name: doc-comments
 description: 'Ensure that C# and C++/CLI types are documented with XML comments and follow best practices for documentation.'
 ---
 
 # C# and C++/CLI Documentation Best Practices
 
-- Public members should be documented with XML comments.
+- All public members in the entire solution should be documented with XML comments.
 - It is encouraged to document internal members as well, especially if they are complex or not self-explanatory.
 
 ## Guidance for all APIs
diff --git a/.claude/skills/release-preparation/SKILL.md b/.claude/skills/release-preparation/SKILL.md
@@ -0,0 +1,60 @@
+---
+name: release-preparation
+description: 'Prepare the DSInternals project for a new release by updating version numbers, release notes, and changelog.'
+---
+
+# Release Preparation Guide
+
+## Copyright Year Updates
+
+If releasing in a new calendar year, update the copyright information first.
+
+## Files to Update
+
+### 1. Assembly Version and NuGet Release Notes
+
+C# project files - Update `<Version>` and `<PackageReleaseNotes>`:
+- [DSInternals.Common.csproj](../../../Src/DSInternals.Common/DSInternals.Common.csproj)
+- [DSInternals.DataStore.csproj](../../../Src/DSInternals.DataStore/DSInternals.DataStore.csproj)
+- [DSInternals.Replication.csproj](../../../Src/DSInternals.Replication/DSInternals.Replication.csproj)
+- [DSInternals.SAM.csproj](../../../Src/DSInternals.SAM/DSInternals.SAM.csproj)
+
+C# project files - Update `<Version>` only (not packable):
+- [DSInternals.ADSI.csproj](../../../Src/DSInternals.ADSI/DSInternals.ADSI.csproj)
+- [DSInternals.Replication.Model.csproj](../../../Src/DSInternals.Replication.Model/DSInternals.Replication.Model.csproj)
+- [DSInternals.PowerShell.csproj](../../../Src/DSInternals.PowerShell/DSInternals.PowerShell.csproj)
+
+C++/CLI interop library:
+- [version.h](../../../Src/DSInternals.Replication.Interop/version.h) - Update `VERSION_MAJOR`, `VERSION_MINOR`, `VERSION_REVISION`, `VERSION_BUILD`.
+
+> [!NOTE]
+> Only increment the version number if the respective assembly has changes or its dependencies have changed.
+
+### 2. PowerShell Module Manifest
+
+[DSInternals.psd1](../../../Src/DSInternals.PowerShell/DSInternals.psd1) - Update `ModuleVersion` and `ReleaseNotes` in the PowerShell module manifest file.
+
+> [!NOTE]
+> `ModuleVersion` must match the assembly version (e.g., `6.3` for assembly `6.3.0.0`).
+
+### 3. Chocolatey Package Specification
+
+[dsinternals-psmodule.nuspec](../../../Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec) - Update `<releaseNotes>` in the Chocolatey package specification.
+
+### 4. Changelog
+
+[CHANGELOG.md](../../../Documentation/CHANGELOG.md) - Add new version section following [Keep a Changelog](https://keepachangelog.com/) format. Update comparison links at the bottom.
+
+## Release Notes Consistency
+
+Release notes should be consistent across files:
+- **CHANGELOG.md**: Most detailed, follows Keep a Changelog format with sections (Added, Changed, Fixed, etc.)
+- **DSInternals.psd1** and **dsinternals-psmodule.nuspec**: Should match each other and contain a relevant subset of the changelog (user-visible changes only)
+
+## Release Preparation Process
+
+1. Update all files listed above with the new version and release notes
+2. Build the solution.
+3. Verify version consistency across all files by running the following Pester tests:
+  - [Integration.Tests.ps1](../../../Src/DSInternals.PowerShell/Tests/Integration.Tests.ps1) verifies module/assembly version match
+  - [Documentation.Tests.ps1](../../../Src/DSInternals.PowerShell/Tests/Documentation.Tests.ps1) verifies changelog contains current version
diff --git a/.claude/skills/update-copyright-year/SKILL.md b/.claude/skills/update-copyright-year/SKILL.md
@@ -0,0 +1,27 @@
+---
+name: update-copyright-year
+description: 'Update copyright year references across the project at the beginning of each calendar year.'
+---
+
+# Yearly Copyright and License Update
+
+This prompt helps update all copyright year references in the DSInternals project at the beginning of each new calendar year.
+
+## Files to Update
+
+The following files contain copyright year references that need to be updated:
+
+- [LICENSE.md](../../../LICENSE.md) - Main project license (MIT License)
+- [Src/Directory.Build.props](../../../Src/Directory.Build.props) - MSBuild properties for all projects
+- [Src/DSInternals.Replication.Interop/version.h](../../../Src/DSInternals.Replication.Interop/version.h) - Version header for native interop library
+- [Src/DSInternals.PowerShell/DSInternals.psd1](../../../Src/DSInternals.PowerShell/DSInternals.psd1) - PowerShell module manifest
+- [Src/DSInternals.PowerShell/License.txt](../../../Src/DSInternals.PowerShell/License.txt) - License file included in binary distributions
+- [Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec](../../../Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec) - Chocolatey package specification
+
+## Important Notes
+
+- The start year (2015) should **never** change - it represents when the project was first created.
+  Only the end year should be updated to the current year.
+- The copyright holder name "Michael Grafnetter" should not be changed.
+- Third-party copyright notices should **not** be modified.
+- No other content in these files should be altered, only the year values. This applies to whitespaces as well.
diff --git a/.github/prompts/release.prompt.md b/.github/prompts/release.prompt.md
diff --git a/.github/prompts/update-copyright-year.prompt.md b/.github/prompts/update-copyright-year.prompt.md
diff --git a/AGENTS.md b/AGENTS.md
@@ -1,4 +1,4 @@
-# GitHub Copilot Instructions for DSInternals
+# Agent Instructions for DSInternals
 
 ## Project Overview
 
@@ -22,7 +22,8 @@ and the [PowerShell module documentation](Documentation/PowerShell/Readme.md) fo
 
 ## Build Instructions
 
-> **Important:** The `Src` directory must be the working directory for all build and test commands due to the `global.json` SDK configuration.
+> [!IMPORTANT]
+> The `Src` directory must be the working directory for all build and test commands due to the `global.json` SDK configuration.
 
 ### Building C# Projects Only
 
@@ -38,7 +39,7 @@ dotnet build DSInternals.DotNetSdk.slnf
 dotnet build DSInternals.Common
 ```
 
-> **Note:** The `dotnet build` command cannot compile C++/CLI projects. Use MSBuild or Visual Studio for full builds including the PowerShell module:
+**Note:** The `dotnet build` command cannot compile C++/CLI projects. Use MSBuild or Visual Studio for full builds including the PowerShell module:
 
 ```powershell
 cd Src
diff --git a/Documentation/CHANGELOG.md b/Documentation/CHANGELOG.md
@@ -9,6 +9,17 @@ All notable changes to this project will be documented in this file. The format
 
 - Nothing yet.
 
+## [6.4] - 2026-03-28
+
+### Changed
+
+- Switched `CborMap.ToJson` to source-generated `System.Text.Json` serialization.
+
+### Fixed
+
+- Fixed MS-SAMR authentication.
+- Fixed an arithmetic overflow in the [Test-PasswordQuality](PowerShell/Test-PasswordQuality.md#test-passwordquality) cmdlet when using an empty dictionary file.
+
 ## [6.3] - 2026-02-08
 
 ### Added
@@ -704,7 +715,8 @@ This is a [Chocolatey](https://chocolatey.org/packages/dsinternals-psmodule)-onl
 ## 1.0 - 2015-01-20
 Initial release!
 
-[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.3...HEAD
+[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.4...HEAD
+[6.4]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.3...v6.4
 [6.3]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.2...v6.3
 [6.2]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.1.1...6.2
 [6.1.1]: https://github.com/MichaelGrafnetter/DSInternals/compare/v6.1...v6.1.1
diff --git a/Src/DSInternals.ADSI/DSInternals.ADSI.csproj b/Src/DSInternals.ADSI/DSInternals.ADSI.csproj
@@ -1,6 +1,6 @@
 ﻿<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals ADSI Library</AssemblyTitle>
   </PropertyGroup>
 
diff --git a/Src/DSInternals.Common/DSInternals.Common.csproj b/Src/DSInternals.Common/DSInternals.Common.csproj
@@ -2,12 +2,11 @@
   <PropertyGroup>
     <!-- NuGet package metadata -->
     <IsPackable>true</IsPackable>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals Common Library</AssemblyTitle>
     <Title>$(AssemblyTitle)</Title>
     <Description>This package is shared between all other DSInternals packages. Its main features are Azure AD Graph API and ADSI clients for for retrieval of cryptographic material. It contains implementations of common hash functions used by Windows, including NT hash, LM hash and OrgId hash. It also contains methods for SysKey/BootKey retrieval.</Description>
-    <PackageReleaseNotes>- Improved generation of NGC keys to meet January 2026 Windows validation changes.
-  - Removed Azure AD Graph API-related code.</PackageReleaseNotes>
+    <PackageReleaseNotes>- Switched CBOR JSON serialization to a source-generated System.Text.Json implementation.</PackageReleaseNotes>
     <PackageTags>ActiveDirectory Security Entra AD AAD Identity Active Directory</PackageTags>
     <!-- Create XML documentation file -->
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
diff --git a/Src/DSInternals.Common/PACKAGE.md b/Src/DSInternals.Common/PACKAGE.md
@@ -3,7 +3,7 @@
 ## Introduction
 
 The **DSInternals.Common** package is the foundational library shared between other DSInternals packages.
-It provides core cryptographic functionality and utilities for working with Active Directory security data.
+It provides core cryptographic functionality and abstractions for working with Active Directory security data.
 
 As this library uses Windows-specific cryptographic APIs (P/Invoke), it is only supported on Windows.
 
diff --git a/Src/DSInternals.DataStore/DSInternals.DataStore.csproj b/Src/DSInternals.DataStore/DSInternals.DataStore.csproj
@@ -2,7 +2,7 @@
   <PropertyGroup>
     <!-- NuGet package metadata -->
     <IsPackable>true</IsPackable>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals DataStore Library</AssemblyTitle>
     <Title>$(AssemblyTitle)</Title>
     <Description>DSInternals DataStore is an advanced framework for offline ntds.dit file manipulation. It can be used to extract password hashes from Active Directory backups or to modify the sIDHistory and primaryGroupId attributes.</Description>
diff --git a/Src/DSInternals.DataStore/PACKAGE.md b/Src/DSInternals.DataStore/PACKAGE.md
@@ -11,7 +11,7 @@ the Active Directory database without running a domain controller.
 - **Account Manipulation**: Modify account attributes like sIDHistory and primaryGroupId
 - **Backup Key Extraction**: Retrieve DPAPI backup keys from the database
 - **Trust Password Extraction**: Extract inter-domain trust passwords and derive Kerberos trust keys
-- **KDS Root Key Access**: Retrieve Key Distribution Service root keys for gMSA password computation
+- **KDS Root Key Access**: Retrieve Key Distribution Service root keys for gMSA and dMSA password computation
 - **LAPS Password Decryption**: Decrypt Windows LAPS encrypted passwords
 - **DNS Zone Export**: Extract DNS resource records from AD-integrated zones
 - **BitLocker Recovery**: Extract BitLocker recovery information
@@ -39,7 +39,7 @@ Console.WriteLine($"Forest Mode: {context.DomainController.ForestMode}");
 using DSInternals.DataStore;
 
 string ntdsPath = @"C:\Backup\ntds.dit";
-byte[] bootKey = /* Extract from SYSTEM registry hive */;
+byte[] bootKey = BootKeyRetriever.GetBootKey(@"C:\Backup\SYSTEM");
 
 using var context = new DirectoryContext(ntdsPath, readOnly: true);
 using var agent = new DirectoryAgent(context);
diff --git a/Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec b/Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec
@@ -36,10 +36,8 @@ The DSInternals PowerShell Module has these main features:
 ## Disclaimer
 Features exposed through these tools are not supported by Microsoft. Improper use might cause irreversible damage to domain controllers or negatively impact domain security.</description>
     <releaseNotes>
-* Added the Add-ADReplSidHistory cmdlet for SID history migration via MS-DRSR.
-* Improved generation of NGC keys to meet January 2026 Windows validation changes.
-* Removed Azure AD Graph API-related cmdlets.
-* Merged the *.psm1 script bootstrapper of the binary PowerShell module into the *.psd1 module manifest.
+* Fixed MS-SAMR authentication.
+* Fixed an arithmetic overflow in Test-PasswordQuality when using an empty dictionary file.
     </releaseNotes>
     <dependencies>
       <!-- Windows Management Framework 5.1+. For OS prior to Windows 10 and Windows Server 2016. -->
diff --git a/Src/DSInternals.PowerShell/DSInternals.PowerShell.csproj b/Src/DSInternals.PowerShell/DSInternals.PowerShell.csproj
@@ -5,7 +5,7 @@
     <!-- Redirect the build directory so that it includes the module name -->
     <ArtifactsPivots>$(Configuration)/DSInternals/$(TargetFramework)</ArtifactsPivots>
     <IncludeSymbols>False</IncludeSymbols>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals PowerShell Commands</AssemblyTitle>
     <!-- Copy all dependency DLLs to the binary module -->
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/Src/DSInternals.PowerShell/DSInternals.psd1 b/Src/DSInternals.PowerShell/DSInternals.psd1
@@ -12,7 +12,7 @@ RootModule = if ($PSEdition -eq 'Core') {
 }
 
 # Version number of this module.
-ModuleVersion = '6.3'
+ModuleVersion = '6.4'
 
 # Supported PSEditions
 CompatiblePSEditions = @('Desktop', 'Core')
@@ -261,10 +261,8 @@ PrivateData = @{
 
         # ReleaseNotes of this module
         ReleaseNotes = @"
-- Added the Add-ADReplSidHistory cmdlet for SID history migration via MS-DRSR.
-- Improved generation of NGC keys to meet January 2026 Windows validation changes.
-- Removed Azure AD Graph API-related cmdlets.
-- Merged the *.psm1 script bootstrapper of the binary PowerShell module into the *.psd1 module manifest.
+- Fixed MS-SAMR authentication.
+- Fixed an arithmetic overflow in Test-PasswordQuality when using an empty dictionary file.
 "@
     } # End of PSData hashtable
 
diff --git a/Src/DSInternals.Replication.Interop/version.h b/Src/DSInternals.Replication.Interop/version.h
@@ -6,7 +6,7 @@
 #define STRINGIZE(s) STRINGIZE2(s)
 
 #define VERSION_MAJOR               6
-#define VERSION_MINOR               3
+#define VERSION_MINOR               4
 #define VERSION_REVISION            0
 #define VERSION_BUILD               0
 
diff --git a/Src/DSInternals.Replication.Model/DSInternals.Replication.Model.csproj b/Src/DSInternals.Replication.Model/DSInternals.Replication.Model.csproj
@@ -1,6 +1,6 @@
 ﻿<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals Replication Data Model</AssemblyTitle>
     <ProduceReferenceAssembly>true</ProduceReferenceAssembly>
     <ProduceReferenceAssemblyInOutDir>true</ProduceReferenceAssemblyInOutDir>
diff --git a/Src/DSInternals.Replication/DSInternals.Replication.csproj b/Src/DSInternals.Replication/DSInternals.Replication.csproj
@@ -4,12 +4,11 @@
     <TargetFrameworks>net48;net8.0-windows</TargetFrameworks>
     <!-- NuGet package metadata -->
     <IsPackable>true</IsPackable>
-    <Version>6.3</Version>
+    <Version>6.4</Version>
     <AssemblyTitle>DSInternals Replication Library</AssemblyTitle>
     <Title>$(AssemblyTitle)</Title>
     <Description>DSInternals Replication implements a client for the Active Directory Replication Service Remote Protocol (DRS-R). It can be used to remotely extract password hashes from domain controllers.</Description>
-    <PackageReleaseNotes>- Added the AddSidHistory method for intra-domain and cross-forest SID history migration via MS-DRSR.
-- Improved package structure.</PackageReleaseNotes>
+    <PackageReleaseNotes>- Updated assembly dependencies.</PackageReleaseNotes>
     <PackageTags>ActiveDirectory Security Replication RPC DRSR DCSync</PackageTags>
     <!-- Override the NuGet package directory structure -->
     <TargetsForTfmSpecificBuildOutput>$(TargetsForTfmSpecificBuildOutput);PackReferenceAssemblies;PackRuntimeAssemblies</TargetsForTfmSpecificBuildOutput>
diff --git a/Src/DSInternals.Replication/PACKAGE.md b/Src/DSInternals.Replication/PACKAGE.md
diff --git a/Src/DSInternals.SAM/DSInternals.SAM.csproj b/Src/DSInternals.SAM/DSInternals.SAM.csproj
diff --git a/Src/DSInternals.SAM/PACKAGE.md b/Src/DSInternals.SAM/PACKAGE.md
