Skip to content

Conversation

@lhaagsma
Copy link
Contributor

@lhaagsma lhaagsma commented Jan 1, 2026

This PR changes the sam plugin to a namespace of sam.users and adds a sam.groups function that parses local groups from SAM.

Some changes are made to t.users to also parse users from sam as the currently implementation seem to fail to return some local users as mentioned in: #1477

Feedback requested:

  • Additionally an attempt is made at more user friendly test-case by using exported .reg files - including tooling to export registry keys and construction of VirtualHives from .reg files.
  • I'd like to add local_admin=Boel to user records somewhere, either in SAM.users or target.users as this would provide a user friendly way to identify local admin users. Because the 'administrators' group name can be changed and is language specific.

Still some work to do, such as fix a test i'm failing (tests/plugins/os/windows/test__os.py::test_windows_user_from_sam) because the Mock target does not get properly parsed by the new target.users implementation that makes use of SAM. A solution is likely a change to the test, rather than a change in the code as I have tested this scenario on a live machine

@EinatFox EinatFox linked an issue Jan 13, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SAM plugin changes

1 participant