Check when the FineGrainedPasswordPolicy is not applied to anything.

sense-of-security · Aug 28, 2018 · 2cb3aa0 · 2cb3aa0
1 parent 701aa88
commit 2cb3aa0
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/ADRecon.ps1 b/ADRecon.ps1
@@ -5817,7 +5817,10 @@ Function Get-ADRFineGrainedPasswordPolicy
                 {
                     $AppliesTo = $AppliesTo + "," + $_.AppliesTo[$i]
                 }
-                $AppliesTo = $AppliesTo.TrimStart(",")
+                If ($null -ne $AppliesTo)
+                {
+                    $AppliesTo = $AppliesTo.TrimStart(",")
+                }
                 $ObjValues = @("Name", $($_.Name), "Applies To", $AppliesTo, "Enforce password history", $_.PasswordHistoryCount, "Maximum password age (days)", $_.MaxPasswordAge.days, "Minimum password age (days)", $_.MinPasswordAge.days, "Minimum password length", $_.MinPasswordLength, "Password must meet complexity requirements", $_.ComplexityEnabled, "Store password using reversible encryption", $_.ReversibleEncryptionEnabled, "Account lockout duration (mins)", $_.LockoutDuration.minutes, "Account lockout threshold", $_.LockoutThreshold, "Reset account lockout counter after (mins)", $_.LockoutObservationWindow.minutes, "Precedence", $($_.Precedence))
                 For ($i = 0; $i -lt $($ObjValues.Count); $i++)
                 {
@@ -5861,7 +5864,10 @@ Function Get-ADRFineGrainedPasswordPolicy
                     {
                         $AppliesTo = $AppliesTo + "," + $_.Properties.'msds-psoappliesto'[$i]
                     }
-                    $AppliesTo = $AppliesTo.TrimStart(",")
+                    If ($null -ne $AppliesTo)
+                    {
+                        $AppliesTo = $AppliesTo.TrimStart(",")
+                    }
                         $ObjValues = @("Name", $($_.Properties.name), "Applies To", $AppliesTo, "Enforce password history", $($_.Properties.'msds-passwordhistorylength'), "Maximum password age (days)", $($($_.Properties.'msds-maximumpasswordage') /-864000000000), "Minimum password age (days)", $($($_.Properties.'msds-minimumpasswordage') /-864000000000), "Minimum password length", $($_.Properties.'msds-minimumpasswordlength'), "Password must meet complexity requirements", $($_.Properties.'msds-passwordcomplexityenabled'), "Store password using reversible encryption", $($_.Properties.'msds-passwordreversibleencryptionenabled'), "Account lockout duration (mins)", $($($_.Properties.'msds-lockoutduration')/-600000000), "Account lockout threshold", $($_.Properties.'msds-lockoutthreshold'), "Reset account lockout counter after (mins)", $($($_.Properties.'msds-lockoutobservationwindow')/-600000000), "Precedence", $($_.Properties.'msds-passwordsettingsprecedence'))
                         For ($i = 0; $i -lt $($ObjValues.Count); $i++)
                         {