> AD-miner -cf RTE_Nokia -u neo4j -p password -co 3 -ch 60
[+]MigrationData : 1 | AIACA : 5 | Group : 473424 | Container : 425 | Computer : 91565 | CertTemplate : 72 | User : 134604 | OU : 8650 | Domain : 9 | GPO : 530 | EnterpriseCA : 3 | NTAuthStore : 1 | RootCA : 2 | Relations : 19052572
[1/150] [+]Requesting : Checking if Graph Data Science neo4j plugin is installed
[+]GDS plugin installed.
[+]Using exploitability for paths computation.
[+]Deleting graph_objects_to_domain_admingraph to prevent conflicts
[-]Done in 0.42 s - 1 objects
[2/150] [+]Requesting : Delete orphan objects that have no labels
[-]Done in 0.33 s - 0 objects
[3/150] [+]Requesting : Clean AD Miner custom attributes
[-]Done in 28.36 s - 0 objects
[4/150] [+]Requesting : Delete objects for which SID could not resolved
[-]Done in 1.57 s - 0 objects
[5/150] [+]Requesting : Delete ADLocalGroup objects
[-]Done in 0.01 s - 0 objects
[6/150] [+]Requesting : Set domain names to upper case when not the case
[-]Done in 0.58 s - 0 objects
[7/150] [+]Requesting : Set domain attributes to domain objects when not the case
[-]Done in 0.01 s - 0 objects
[8/150] [+]Requesting : Check for unexisting domain objects
[-]Done in 0.37 s - 1 objects
[9/150] [+]Requesting : Clean AD Miner custom relations
[-]Done in 0.03 s - 0 objects
[10/150] [+]Requesting : Set is_server=TRUE to computers for which operatingsystem contains Server)
[-]Done in 0.10 s - 0 objects
[11/150] [+]Requesting : Set is_server=FALSE to other computers )
[-]Done in 0.79 s - 0 objects
[12/150] [+]Requesting : Set dc=TRUE to computers that are domain controllers)
[-]Done in 0.27 s - 0 objects
[13/150] [+]Requesting : Set dc=FALSE to computers that are not domain controllers)
[-]Done in 0.48 s - 0 objects
[14/150] [+]Requesting : Setting onpremid in case of old collector
[-]Done in 0.21 s - 0 objects
[15/150] [+]Requesting : ADD CanExtractDCSecrets relation from BACKUP OPERATORS OR SERVER OPERATORS groups to DCs of same domain
[-]Done in 0.24 s - 0 objects
[16/150] [+]Requesting : ADD UnconstrainedDelegations relation from objects with KUD to the corresponding domain
[-]Done in 0.77 s - 0 objects
[17/150] [+]Requesting : Set is_adminsdholder to Container with AdminSDHOLDER in name
[-]Done in 0.04 s - 0 objects
[18/150] [+]Requesting : Set is_dnsadmin to Group with DNSAdmins in name
[-]Done in 0.02 s - 0 objects
[19/150] [+]Requesting : ADD CanLoadCode relation from PRINT OPERATORS groups to DCs of same domain
[-]Done in 0.11 s - 0 objects
[20/150] [+]Requesting : ADD CanLogOnLocallyOnDC relation from ACCOUNT OPERATORS groups to DCs of same domain
[-]Done in 0.07 s - 0 objects
[21/150] [+]Requesting : Set da=TRUE to users that are domain admins or administrators or enterprise admin
[-]Done in 0.20 s - 0 objects
[22/150] [+]Requesting : Set the da type (domain, enterprise, key or builtin)
[-]Done in 0.42 s - 0 objects
[23/150] [+]Requesting : Set da=TRUE to groups that are domain admins or administrators or enterprise admin
[-]Done in 0.23 s - 0 objects
[24/150] [+]Requesting : Set the da type (domain, enterprise, key or builtin)
[-]Done in 0.31 s - 0 objects
[25/150] [+]Requesting : Set da=TRUE to groups that are domain admins or administrators or enterprise admin
[-]Done in 0.28 s - 0 objects
[26/150] [+]Requesting : Set the da type (domain, enterprise, key or builtin)
[-]Done in 0.35 s - 0 objects
[27/150] [+]Requesting : Set dag=TRUE to the exact domain admin group (end with 512)
[-]Done in 0.06 s - 0 objects
[28/150] [+]Requesting : Set is_da=FALSE to all objects that do not have is_da=TRUE
[-]Done in 6.30 s - 0 objects
[29/150] [+]Requesting : Set is_dag=FALSE to all objects that do not have is_da=TRUE
[-]Done in 5.19 s - 0 objects
[30/150] [+]Requesting : Delete AdminTo edges from non-DA to DC
[-]Done in 0.11 s - 0 objects
[31/150] [+]Requesting : Set is_group_operator to Operator Groups (cf: ACCOUNT OPERATORS, SERVER OPERATORS, BACKUP OPERATORS, PRINT OPERATORS)
[-]Done in 0.17 s - 0 objects
[32/150] [+]Requesting : Set is_operator_member to objects member of Operator Groups (cf: ACCOUNT OPERATORS, SERVER OPERATORS, BACKUP OPERATORS, PRINT OPERATORS)
[-]Done in 0.37 s - 0 objects
[33/150] [+]Requesting : Set dcsync=TRUE to nodes that can DCSync (GetChanges/GetChangesAll)
scope size : 709290 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [01:49<00:00, 1.83s/it]
[-]Done in 1.83 m - 0 objects
[34/150] [+]Requesting : Set dcsync=TRUE to nodes that can DCSync (GenericAll/AllExtendedRights)
scope size : 709290 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [02:04<00:00, 2.07s/it]
[-]Done in 2.07 m - 0 objects
[35/150] [+]Requesting : Get list of objects that can DCsync (and should probably not be to)
[-]Done in 0.23 s - 0 objects
[36/150] [+]Requesting : Set ou_candidate=TRUE to candidates eligible to shortestou to DA
[-]Done in 2.62 s - 0 objects
[37/150] [+]Requesting : Set contains_da_dc=TRUE to all objects that contains a domain administrator
[-]Done in 0.39 s - 23 objects
[38/150] [+]Requesting : Set contains_da_dc=TRUE to all objects that contains a domain controller
[-]Done in 0.40 s - 30 objects
[39/150] [+]Requesting : Set is_da_dc=TRUE to all objects that are domain controller or domain admins
[-]Done in 0.48 s - 0 objects
[40/150] [+]Requesting : Set is_da_dc=FALSE to objects without is_da_dc = TRUE
[-]Done in 7.11 s - 0 objects
[41/150] [+]Requesting : Set path_candidate=TRUE to candidates eligible to shortestPath to DA
[-]Done in 5.88 s - 0 objects
[42/150] [+]Requesting : Set members_count to groups (recursivity = 5)
scope size : 473424 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [01:58<00:00, 1.98s/it]
[-]Done in 1.98 m - 0 objects
[43/150] [+]Requesting : Set has_member=True to groups with member, else false
[-]Done in 4.05 s - 0 objects
[44/150] [+]Requesting : Set the count of links/object where the GPO is applied
[-]Done in 0.28 s - 0 objects
[45/150] [+]Requesting : Set has_links=True to GPOs with links, else false
[-]Done in 0.03 s - 0 objects
[46/150] [+]Requesting : Set is_adcs to ADCS servers
[-]Done in 0.13 s - 5 objects
[47/150] [+]Requesting : Set groups which are direct admins of computers
[-]Done in 0.02 s - 0 objects
[48/150] [+]Requesting : 1 - Set groups which are indirect admins of computers, ie. admins of admin groups (see precedent request)
[-]Done in 0.85 s - 0 objects
[49/150] [+]Requesting : 2 - Set groups which are indirect admins of computers, ie. admins of admin groups (see precedent request)
[-]Done in 0.06 s - 0 objects
[50/150] [+]Requesting : 3 - Set groups which are indirect admins of computers, ie. admins of admin groups (see precedent request)
[-]Done in 0.04 s - 0 objects
[51/150] [+]Requesting : 4 - Set groups which are indirect admins of computers, ie. admins of admin groups (see precedent request)
[-]Done in 0.05 s - 0 objects
[52/150] [+]Requesting : Set target_kud attribute on nodes that are configured for KUD
[-]Done in 0.36 s - 0 objects
[53/150] [+]Requesting : Set relationships between On premiser User and Azure User
[-]Done in 0.04 s - 0 objects
[54/150] [+]Requesting : Count number of domains collected
[-]Done in 0.06 s - 2 objects
[55/150] [+]Requesting : Count number of users in group
[-]Done in 6.80 s - 0 objects
[56/150] [+]Requesting : Returns all users member of an admin group
[-]Done in 6.53 s - 0 objects
[57/150] [+]Requesting : Returns all groups member of an admin group
[-]Done in 0.63 s - 0 objects
[58/150] [+]Requesting : Returns all computers administrated by an admin group
[-]Done in 0.02 s - 0 objects
[59/150] [+]Requesting : Return direct admin users
[-]Done in 0.02 s - 0 objects
[60/150] [+]Requesting : Set ghost_computer=TRUE to computers that did not login for more than 90 days
[-]Done in 0.31 s - 0 objects
[61/150] [+]Requesting : Set default exploitability rating (r.cost=100) to all relations
[!]{code: Neo.DatabaseError.Statement.ExecutionFailed} {message: Java heap space}
[!]Traceback (most recent call last):
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/__main__.py", line 77, in populate_data_and_cache
neo4j.process_request(neo4j, request_key)
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 385, in process_request
result = self.simpleRequest(self, request_key)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 428, in simpleRequest
result = tx.run(request["request"])
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/transaction.py", line 156, in run
result._tx_ready_run(query, parameters)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 120, in _tx_ready_run
self._run(query, parameters, None, None, None, None)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 166, in _run
self._attach()
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 274, in _attach
self._connection.fetch_message()
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_common.py", line 180, in inner
func(*args, **kwargs)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_bolt.py", line 658, in fetch_message
res = self._process_message(tag, fields)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_bolt4.py", line 326, in _process_message
response.on_failure(summary_metadata or {})
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_common.py", line 247, in on_failure
raise Neo4jError.hydrate(**metadata)
neo4j.exceptions.DatabaseError: {code: Neo.DatabaseError.Statement.ExecutionFailed} {message: Java heap space}
[62/150] [+]Requesting : Checking for unknown relations
[-]Setting exploitability ratings to edges.
[!]{code: Neo.TransientError.General.OutOfMemoryError} {message: There is not enough memory to perform the current task. Please try increasing 'dbms.memory.heap.max_size' in the neo4j configuration (normally in 'conf/neo4j.conf' or, if you are using Neo4j Desktop, found through the user interface) or if you are running an embedded installation increase the heap by using '-Xmx' command line flag, and then restart the database.}
[!]Traceback (most recent call last):
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/__main__.py", line 77, in populate_data_and_cache
neo4j.process_request(neo4j, request_key)
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 391, in process_request
request["postProcessing"](self, result)
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 946, in check_unkown_relations
tx.run(q)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/transaction.py", line 156, in run
result._tx_ready_run(query, parameters)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 120, in _tx_ready_run
self._run(query, parameters, None, None, None, None)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 166, in _run
self._attach()
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/work/result.py", line 274, in _attach
self._connection.fetch_message()
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_common.py", line 180, in inner
func(*args, **kwargs)
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_bolt.py", line 658, in fetch_message
res = self._process_message(tag, fields)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_bolt4.py", line 326, in _process_message
response.on_failure(summary_metadata or {})
File "/opt/homebrew/lib/python3.12/site-packages/neo4j/_sync/io/_common.py", line 247, in on_failure
raise Neo4jError.hydrate(**metadata)
neo4j.exceptions.TransientError: {code: Neo.TransientError.General.OutOfMemoryError} {message: There is not enough memory to perform the current task. Please try increasing 'dbms.memory.heap.max_size' in the neo4j configuration (normally in 'conf/neo4j.conf' or, if you are using Neo4j Desktop, found through the user interface) or if you are running an embedded installation increase the heap by using '-Xmx' command line flag, and then restart the database.}
[63/150] [+]Requesting : List of domains
[-]Done in 0.39 s - 9 objects
[64/150] [+]Requesting : Number of domain controllers
[-]Done in 0.20 s - 30 objects
[65/150] [+]Requesting : Domain Organisational Units
[-]Done in 9.59 s - 706892 objects
[66/150] [+]Requesting : Non privileged users that can impersonate privileged users
scope size : 117339 | nb chunks : 60
7%|██████████████████▍ | 4/60 [15:33<1:58:30, 126.98s/it]
50%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████▌ | 30/60 [23:13<08:35, 17.20s/it]
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [33:35<00:00, 33.59s/it]
[-]Done in 33.60 m - 0 objects
[67/150] [-]Skipping request : users_shadow_credentials_to_non_admins (config.json)
[68/150] [+]Requesting : Number of domain accounts enabled
[-]Done in 2.27 s - 117350 objects
[69/150] [+]Requesting : Number of domain accounts disabled
[-]Done in 0.46 s - 17253 objects
[70/150] [+]Requesting : Number of groups
[-]Done in 8.74 s - 473424 objects
[71/150] [+]Requesting : Number of computers
[-]Done in 1.94 s - 91517 objects
[72/150] [+]Requesting : Computers not connected since
[-]Done in 1.73 s - 91565 objects
[73/150] [+]Requesting : Number of domain admin accounts
[-]Done in 1.21 s - 11 objects
[74/150] [+]Requesting : Number of OS
[-]Done in 1.67 s - 78762 objects
[75/150] [+]Requesting : Kerberos password last change in days
[-]Done in 0.06 s - 1 objects
[76/150] [+]Requesting : Number of Kerberoastable accounts
[-]Done in 0.23 s - 44 objects
[77/150] [+]Requesting : Number of AS-REP Roastable accounts
[-]Done in 0.19 s - 0 objects
[78/150] [+]Requesting : Number of machines with unconstrained delegations
[-]Done in 0.11 s - 0 objects
[79/150] [+]Requesting : Number of users with unconstrained delegations
[-]Done in 0.21 s - 0 objects
[80/150] [+]Requesting : Number of users with constrained delegations
[-]Done in 0.02 s - 1 objects
[81/150] [+]Requesting : Dormant accounts
[-]Done in 0.44 s - 12269 objects
[82/150] [+]Requesting : Password last change in days
[-]Done in 2.25 s - 117350 objects
[83/150] [+]Requesting : Number of accounts where password cleartext password is populated
[-]Done in 0.08 s - 0 objects
[84/150] [+]Requesting : Number of accounts where password is not required
[-]Done in 0.77 s - 0 objects
[85/150] [+]Requesting : N objects have AdminSDHolder
[-]Done in 0.99 s - 21 objects
[86/150] [+]Requesting : Password never expired
[-]Done in 0.20 s - 3247 objects
[87/150] [+]Requesting : High privilege group computer member
[-]Done in 1.50 s - 0 objects
[88/150] [+]Requesting : Objects with path to DA
[!]cannot convert float NaN to integer
[!]Traceback (most recent call last):
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/__main__.py", line 77, in populate_data_and_cache
neo4j.process_request(neo4j, request_key)
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 383, in process_request
result = self.writeRequest(self, request_key)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 425, in simpleRequest
result = self.computePathObject(result,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.12/site-packages/ad_miner/sources/modules/neo4j_class.py", line 874, in computePathObject
gds_identifier = round(1000 * (gds_identifier % 1))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: cannot convert float NaN to integer
[89/150] [+]Requesting : Objects with path to ADCS servers
scope size : 691979 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [01:41<00:00, 1.69s/it]
[-]Done in 1.72 m - 0 objects
[90/150] [+]Requesting : Users admin on machines
[-]Done in 0.34 s - 0 objects
[91/150] [+]Requesting : Users admin on servers n°1
scope size : 117339 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [00:05<00:00, 10.69it/s]
[-]Done in 6.16 s - 117339 objects
[92/150] [+]Requesting : Users admin on servers n°2
scope size : 117339 | nb chunks : 60
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 60/60 [00:28<00:00, 2.11it/s]
[-]Done in 28.97 s - 117339 objects
[93/150] [+]Requesting : Number of computers admin of computers
[-]Done in 0.20 s - 0 objects
[94/150] [+]Requesting : Domain map trust
[-]Done in 0.04 s - 9 objects
[95/150] [+]Requesting : Shortest paths to objects configured for KUD
scope size : 208874 | nb chunks : 60
0%| | 0/60 [00:00<?, ?it/s]
{
"requests": {
"delete_orphans": "true",
"preparation_request_nodes": "true",
"delete_unresolved": "true",
"set_upper_domain_name": "true",
"preparation_request_relations": "true",
"set_server": "true",
"set_non_server": "true",
"set_dc": "true",
"set_nondc": "true",
"set_can_extract_dc_secrets": "true",
"set_unconstrained_delegations": "true",
"set_is_adminsdholder": "true",
"set_is_dnsadmin": "true",
"set_can_load_code": "true",
"set_can_logon_dc": "true",
"set_da": "true",
"set_da_types": "true",
"set_dag": "true",
"set_dag_types": "true",
"set_dagg": "true",
"set_dagg_types": "true",
"set_daggg": "true",
"set_nonda": "true",
"set_nondag": "true",
"del_fake_dc_admins": "true",
"set_is_group_operator": "true",
"set_is_operator_member": "true",
"set_dcsync1": "true",
"set_dcsync2": "true",
"dcsync_list": "true",
"set_path_candidate": "true",
"set_ou_candidate": "true",
"set_containsda": "true",
"set_containsdc": "true",
"set_is_da_dc": "true",
"set_groups_members_count": "true",
"set_groups_has_members": "true",
"set_gpo_links_count": "true",
"set_gpos_has_links": "true",
"set_is_adcs": "true",
"set_groups_direct_admin": "true",
"set_groups_indirect_admin_1": "true",
"set_groups_indirect_admin_2": "true",
"set_groups_indirect_admin_3": "true",
"set_groups_indirect_admin_4": "true",
"set_synced_OP_user_AZ_user": "true",
"nb_domain_collected": "true",
"get_count_of_member_admin_group": "true",
"get_users_linked_admin_group": "true",
"get_groups_linked_admin_group": "true",
"get_computers_linked_admin_group": "true",
"get_users_direct_admin": "true",
"set_ghost_computer": "true",
"domains": "true",
"nb_domain_controllers": "true",
"domain_OUs": "true",
"users_shadow_credentials": "true",
"users_shadow_credentials_to_non_admins": "false",
"nb_enabled_accounts": "true",
"nb_groups": "true",
"nb_computers": "true",
"computers_not_connected_since": "true",
"nb_domain_admins": "true",
"os": "true",
"krb_pwd_last_change": "true",
"nb_kerberoastable_accounts": "true",
"nb_as-rep_roastable_accounts": "true",
"nb_computer_unconstrained_delegations": "true",
"nb_users_unconstrained_delegations": "true",
"users_constrained_delegations": "true",
"dormant_accounts": "true",
"password_last_change": "true",
"nb_user_password_cleartext": "true",
"get_users_password_not_required": "true",
"objects_admincount": "true",
"user_password_never_expires": "true",
"computers_members_high_privilege": "true",
"objects_to_domain_admin": "true",
"objects_to_adcs": "true",
"users_admin_on_computers": "true",
"users_admin_on_servers_1": "true",
"users_admin_on_servers_2": "true",
"computers_admin_on_computers": "true",
"domain_map_trust": "true",
"objects_to_unconstrained_delegation": "false",
"users_to_unconstrained_delegation": "false",
"nb_computers_laps": "true",
"can_read_laps": "true",
"objects_to_dcsync": "true",
"dom_admin_on_non_dc": "true",
"unpriv_to_dnsadmins": "true",
"rdp_access": "true",
"dc_impersonation": "true",
"rbcd": "true",
"graph_rbcd": "false",
"graph_rbcd_to_da": "true",
"objects_to_ou_handlers": "true",
"vuln_functional_level": "true",
"vuln_sidhistory_dangerous": "true",
"can_read_gmsapassword_of_adm": "true",
"objects_to_operators_member": "true",
"vuln_permissions_adminsdholder": "true",
"da_to_da": "true",
"anomaly_acl_1": "true",
"anomaly_acl_2": "true",
"get_empty_groups": "true",
"get_empty_ous": "true",
"has_sid_history": "true",
"unpriv_users_to_GPO_init": "true",
"unpriv_users_to_GPO_user_enforced": "true",
"unpriv_users_to_GPO_user_not_enforced": "true",
"unpriv_users_to_GPO_computer_enforced": "true",
"unpriv_users_to_GPO_computer_not_enforced": "true",
"unpriv_users_to_GPO": "true",
"cross_domain_local_admins": "true",
"cross_domain_domain_admins": "true",
"primaryGroupID_lower_than_1000": "true",
"pre_windows_2000_compatible_access_group": "true",
"guest_accounts": "true",
"unpriviledged_users_with_admincount": "true",
"fgpp": "true",
"kud":"true",
"set_target_kud":"true",
"azure_set_gag": "true",
"azure_user": "true",
"azure_admin": "true",
"azure_groups": "true",
"azure_vm": "true",
"azure_users_paths_high_target": "true",
"azure_ms_graph_controllers": "true",
"azure_aadconnect_users": "true",
"azure_admin_on_prem": "true",
"azure_role_listing": "true",
"azure_role_paths": "true",
"azure_reset_passwd": "true",
"azure_last_passwd_change": "false",
"azure_dormant_accounts": "true",
"azure_accounts_disabled_on_prem": "true",
"azure_accounts_not_found_on_prem": "true",
"azure_tenants": "true",
"azure_ga_to_ga": "true",
"azure_cross_ga_da": "true"
}
}