Domain Authenticated users is member of Authenticated users on Domain…

… members
lkarlslund · Sep 27, 2022 · b5e5231 · b5e5231
1 parent de0d736
commit b5e5231
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/modules/integrations/localmachine/analyze/import.go b/modules/integrations/localmachine/analyze/import.go
@@ -138,8 +138,12 @@ func ImportCollectorInfo(ao *engine.Objects, cinfo localmachine.Info) (*engine.O
 
 	authenticatedusers, _, _ := ri.GetSIDObject(windowssecurity.AuthenticatedUsersSID, Auto)
 	authenticatedusers.SetFlex(engine.ObjectCategorySimple, "Group") // This could go wrong
+	authenticatedusers.EdgeTo(everyone, activedirectory.EdgeMemberOfGroup)
 
-	everyone.EdgeTo(authenticatedusers, activedirectory.EdgeMemberOfGroup)
+	if cinfo.Machine.IsDomainJoined {
+		domainauthenticatedusers, _, _ := ri.GetSIDObject(windowssecurity.EveryoneSID, Domain)
+		domainauthenticatedusers.EdgeTo(authenticatedusers, activedirectory.EdgeMemberOfGroup)
+	}
 
 	var macaddrs, ipaddresses []string