From 2f6701bc6047fc55676891b038c93f121c857b3d Mon Sep 17 00:00:00 2001 From: Sreeparna Singhal Date: Wed, 16 Jul 2025 16:36:51 +0100 Subject: [PATCH 1/2] Script updates complete for PingCastle 3.3 --- docs/pingcastle/3.3/enterpriseinstall.md | 108 +++++++++------- docs/pingcastle/3.3/enterpriseupgrade.md | 10 +- docs/pingcastle/3.3/enterpriseuser.md | 66 +++++----- docs/pingcastle/3.3/index.md | 157 ++++++++++++----------- docs/pingcastle/3.3/proinstall.md | 46 ++++--- docs/pingcastle/3.3/proupgrade.md | 2 +- docs/pingcastle/3.3/prouser.md | 14 +- 7 files changed, 216 insertions(+), 187 deletions(-) diff --git a/docs/pingcastle/3.3/enterpriseinstall.md b/docs/pingcastle/3.3/enterpriseinstall.md index bc5ee23fa2..3bdec92645 100644 --- a/docs/pingcastle/3.3/enterpriseinstall.md +++ b/docs/pingcastle/3.3/enterpriseinstall.md @@ -11,7 +11,7 @@ management, thus improving over time. # Requirements -System Specifications +**System Specifications** The Operating systems supported are: @@ -78,7 +78,7 @@ include subdomains of a forest. Enterprise licenses are bundled in packs of 10 domains, up to 60, with an unlimited license thereafter. -Example +**Example** If you have consto.com with two subdomains called uk.consto.com and us.consto.com, then you would require the 10-domain licensing pack. @@ -175,7 +175,7 @@ to the database to IIS (application pool) # Various options -Custom login message +**Custom login message** You can define a custom message at the login page. You have to use the custom option "customLoginMessage". @@ -195,7 +195,7 @@ JAVASCRIPT. # Post Installation - Scheduler -Quick installation +**Quick installation** PingCastle allows the possibility to the administrator of the application to schedule scans. It is useful when the solution is @@ -228,9 +228,11 @@ the access to the task scheduler cannot be delegated. ## Custom installation -Note: PingCastle is using behing the hood a folder named "PingCastle" in +:::note +PingCastle is using behing the hood a folder named "PingCastle" in the task scheduler. We will use the COM api as it exposes the security descriptor -- which is not the case of the native PowerShell APIL +::: If you want PingCastle to be able to start or stop tasks but not being able to edit them (it requires that the account is local admin), you @@ -240,21 +242,21 @@ the following actions as admin in powershell: ```powershell # connect to the task scheduler service -$scheduleObject = New-Object -ComObject schedule.service +**$scheduleObject = New-Object -ComObject schedule.service** $scheduleObject.connect() -$rootFolder = $scheduleObject.GetFolder("") +**$rootFolder = $scheduleObject.GetFolder("")** $PingCastleFolder = $rootFolder.GetFolder("PingCastle") -$PingCastleFolder.GetTasks(1) | Foreach-Object { +**$PingCastleFolder.GetTasks(1) | Foreach-Object {** $sddl = $_.GetSecurityDescriptor(1+2+4+8) # add full control to the task -$sddl += "(A;S-1-XXX-XXX-XXX;FA;;;SY)" +**$sddl += "(A;S-1-XXX-XXX-XXX;FA;;;SY)"** $_.SetSecurityDescriptor($sddl, 0) @@ -291,11 +293,11 @@ core 8.0 middleware. Microsoft has procedures to install the dotnet core 2 framework: -Linux installation +**Linux installation** - https://docs.microsoft.com/en-us/dotnet/core/linux-prerequisites?tabs=netcore2x -Windows installation +**Windows installation** - https://docs.microsoft.com/en-us/dotnet/core/windows-prerequisites?tabs=netcore2x @@ -350,13 +352,13 @@ The following SQL can grant these permissions: ```sql If not Exists (select loginname from master.dbo.syslogins -where loginname = 'IIS APPPOOL\PingCastleEnterprise') +**where loginname = 'IIS APPPOOL\PingCastleEnterprise')** Begin CREATE LOGIN [IIS APPPOOL\PingCastleEnterprise] FROM WINDOWS; -End +**End** use PingCastleEnterprise; @@ -373,7 +375,9 @@ sudo apt-get install postgresql postgresql-contrib sudo /etc/init.d/postgresql start ``` -Note: by default no password for the user postgres +:::note +By default no password for the user postgres +::: ```bash sudo -u postgres createuser pingcastle @@ -390,7 +394,7 @@ sudo -u postgres createdb -O pingcastle pingcastle ## Using a Database Hosted on Anther Server -Configure SQL Server with a local DB account +**Configure SQL Server with a local DB account** ![](/img/product_docs/pingcastle/enterpriseinstall/image18.png) @@ -406,7 +410,7 @@ later the password inside the application.Production.json file) ![](/img/product_docs/pingcastle/enterpriseinstall/image20.png) -Then create a database +**Then create a database** Do not forget to set the owner as the user you created before. @@ -445,7 +449,7 @@ need to be escaped as they are located inside a json string. ![Une image contenant texte, Police, nombre, logiciel Description générée automatiquement](/img/product_docs/pingcastle/enterpriseinstall/image26.png) -Configure SQL Server with an Active Directory user +**Configure SQL Server with an Active Directory user** You need to first create this Windows user. @@ -514,13 +518,13 @@ For the license, the parameter is stored in the \"License\" setting. Here are some connection string examples: -Sql Local DB +**Sql Local DB** ```json "Server=(localdb)\\mssqllocaldb;Database=aspnet-PingCastleEnterprise-9521AD04-BA3A-41DC-A454-F2BD464E9391;Trusted_Connection=True;MultipleActiveResultSets=true" ``` -PostGres +**PostGres** ```json "DefaultConnection": @@ -541,7 +545,7 @@ PingCastle supports: - SAML2 authentication -Configure active directory authentication +**Configure active directory authentication** The asp.net core middleware requires IIS to provide the authentication layer. As a consequence, the application do not access directly the @@ -604,7 +608,7 @@ API calls will need in addition to their API key a Windows account. directive, as incidated on https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization -Configure OpenID Authentication +**Configure OpenID Authentication** PingCastle Enterprise supports natively OpenID authentication. It is using the asp.net core API whose configuration file is [defined here](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.builder.openidconnectoptions?view=aspnetcore-1.1&viewFallbackFrom=aspnetcore-8.0). The proxy settings rely on the current user proxy configuration (which @@ -631,7 +635,7 @@ property in the appsettings.json file. ![](/img/product_docs/pingcastle/enterpriseinstall/image42.png) -Configure AzureAD authentication as OpenID +**Configure AzureAD authentication as OpenID** Connect to https://portal.azure.com to go to "App registrations". Then register an application. @@ -649,7 +653,7 @@ Clic on "Grant admin consent for " the application ![Une image contenant texte Description générée automatiquement](/img/product_docs/pingcastle/enterpriseinstall/image45.png) -After the action, the Status is changed +**After the action, the Status is changed** ![Une image contenant texte Description générée automatiquement](/img/product_docs/pingcastle/enterpriseinstall/image46.png) @@ -669,16 +673,16 @@ to the following one: ```json "OpenIdConnect": { -"DisplayName": "AzureAD", +**"DisplayName": "AzureAD",** "ClientId": "", -"Authority": "https://login.microsoftonline.com//", +**"Authority": "https://login.microsoftonline.com//",** } ``` -Configure header authentication +**Configure header authentication** You need to edit the appsettings.json file. @@ -700,7 +704,7 @@ property in the appsettings.json file. ![](/img/product_docs/pingcastle/enterpriseinstall/image38.png) -Configure SAML2 authentication +**Configure SAML2 authentication** If you want to hide the internal accounts, you can set the following property in the appsettings.json file. @@ -711,7 +715,7 @@ PingCastle Enterprise supports natively SAML2 authentication. PingCastle is using behind the scenes the component [ITfoxtec Identity SAML 2.0](https://www.itfoxtec.com/IdentitySaml2). The advanced and explicit configuration settings documentation can be [found here](https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/master/src/ITfoxtec.Identity.Saml2/Configuration/Saml2Configuration.cs). The proxy settings rely on the current user proxy configuration (which can be defined [using netsh for IIS running as SYSTEM](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-proxy-internet?view=o365-worldwide)). -Easy configuration +**Easy configuration** This option requires that the IdP can be accessed directly by the server. This may conflict with one premise deployment where the server @@ -747,7 +751,7 @@ Give your app a name and click Next. ![Config App](/img/product_docs/pingcastle/enterpriseinstall/image55.png) -In Single Sign on URL, enter https://yourPingCastleServer/Saml2/AssertionConsumerService +**In Single Sign on URL, enter https://yourPingCastleServer/Saml2/AssertionConsumerService** In Audience URI, enter PingCastle or the value that will be used in the "Issuer" setting. @@ -773,7 +777,7 @@ You are now ready to use SAML2 as authentication. ![](/img/product_docs/pingcastle/enterpriseinstall/image58.png) -Advanced configuration +**Advanced configuration** To remove the need for the IdP metadata query to the remote server, the saml configuration can be set manually. For this procedure, we follow @@ -803,14 +807,14 @@ certificate. It can be seen also in the metadata: The configuration relies on the ITFoxTec SAML2 provider and thus, advanced settings can be seen [here](https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/ede215bda2fd163367d475ca6104ec8ccb7642d3/src/ITfoxtec.Identity.Saml2/Configuration/Saml2Configuration.cs) -ADFS +**ADFS** When using ADFS, the well known configuration is: ```json "Saml2": { -"Issuer": "https://xxx/Saml2/Login", +**"Issuer": "https://xxx/Saml2/Login",** "IdPMetadata": "https://xxx/FederationMetadata/2007-06/FederationMetadata.xml" @@ -818,11 +822,13 @@ When using ADFS, the well known configuration is: }, ``` -Note: you can customize the "SAML2" name in the login page by setting +:::note +You can customize the "SAML2" name in the login page by setting the field DisplayName in the Saml2 section in the configuration file to the value you want. +::: -Configure Client certificate authentication +**Configure Client certificate authentication** The first step is to configure the webserver to require a client certificate when establishing the SSL connection. It requires SSL (aka a @@ -849,9 +855,11 @@ webserver sent a certificate. Then the certificate will be evaluated to verify it is trusted (chain building, online verification) and map it to a user account. -Note: if no CRL or OCSP endpoint is available on all certificate, or if +:::note +If no CRL or OCSP endpoint is available on all certificate, or if they cannot be joined, the verification will have to be turned OFF using the setting CertificateAuthNoRevocation. +::: ![](/img/product_docs/pingcastle/enterpriseinstall/image65.png) @@ -872,7 +880,7 @@ dns form). Please note that no password needs to be submitted. ![](/img/product_docs/pingcastle/enterpriseinstall/image67.png) -Email +**Email** PingCastle requires a configuration to be able to send emails. @@ -980,7 +988,7 @@ shown to create the first user. This user is given the \"Admin\" role. For more details please see the user documentation. -Entities +**Entities** PingCastle configures by default an entity named \"Default\". It is the entity where Auto Created domains are assigned. @@ -995,7 +1003,7 @@ to edit a base hierarchy using an Excel file. This Excel file is the same used in the PingCastleReporting tool. -Encryption +**Encryption** PingCastle Enterprise comes by default with the PingCastle default encryption key. @@ -1003,12 +1011,12 @@ encryption key. If you decided to add a custom ciphering key, you can add it in Advanced -\> Decryption. -Bulk Import of existing reports +**Bulk Import of existing reports** You can import existing report using the bulk import functionality of the Advanced -\> Interoperability menu. -Agents +**Agents** You can configure PingCastle program to send their report to the program. @@ -1032,7 +1040,7 @@ To avoid any hole in security architecture, it was chosen to not run PingCastle scans from the web application. That means that the local domains have to push their information into PingCastle Enterprise. -Program +**Program** It is recommended to run the latest official version of PingCastle. The PingCastle.exe program delivered in the same directory than the @@ -1043,7 +1051,7 @@ audit program at a higher or lower version. If new features have been added, they will not be visible unless the PingCastle Enterprise program is updated, but no data will be lost in the mean time. -Schedule +**Schedule** The best way to schedule it is to run your own scheduler. Indeed, you may have purchase a batch product which is looking for failure or @@ -1056,7 +1064,7 @@ scheduler. The recommended frequency is every week, using a normal user account (not privileged) running on a batch server (not a DC). -Command +**Command** You need to create an API key with the upload right (the \"Agent\" page as admin). @@ -1078,11 +1086,11 @@ PingCastle Enterprise supports a synchronization mode to implement a security zone model (used within the Defense). Ony domains are synchronized (no AzureAD). -PingCastle Enterprise high trust +**PingCastle Enterprise high trust** PingCastle Enterprise high trust -PingCastle Enterprise low trust +**PingCastle Enterprise low trust** PingCastle audits @@ -1205,7 +1213,7 @@ The method to run the application manually is to run the command: dotnet.exe PingCastleEnterprise.dll ``` -(dotnet.exe is stored by default on c:\\program files\\dotnet) +**(dotnet.exe is stored by default on c:\\program files\\dotnet)** Additionnally, you can choose to open the application on the network by specifying the \--server.urls parameter: @@ -1221,7 +1229,7 @@ service connect under IIS APPPool\\AppName. We recommend to look at the following page to grant right to the application pool account on Sql Server: -https://blogs.msdn.microsoft.com/ericparvin/2015/04/14/how-to-add-the-applicationpoolidentity-to-a-sql-server-login +**https://blogs.msdn.microsoft.com/ericparvin/2015/04/14/how-to-add-the-applicationpoolidentity-to-a-sql-server-login** Then depending on the platform additional logs can be stored. @@ -1270,7 +1278,9 @@ Solution: identify the correct version of the framework and install it. Do not forget to install the IIS middleware is you are installing on IIS. -Note: the last error was related to the missing KB KB2533623 +:::note +The last error was related to the missing KB KB2533623 +::: ## Missing web.config @@ -1381,7 +1391,7 @@ Follow the steps to enable debug logging. 5. From the same directory, open the **web.config** file and edit the **aspNetCore** tag so **stdoutLogEnabled=true**. -Example +**Example** ```xml - +**** - +**** @@ -584,47 +584,47 @@ Private Key (used on the decryption side): ```xml - +**** +**6IQbgkAxLTMo4CUmtUQ6GvjwFwE="/>** - +**** ``` -Done +**Done** Task Generate Key completed @@ -642,8 +642,10 @@ PingCastle --reload-report report.xml --encrypt PingCastle --reload-report encrypted-report.xml ``` -Note: Only one key can be specified for encryption but multiple keys can +:::note +Only one key can be specified for encryption but multiple keys can be used for decryption. Their selection is automatic. +::: ### Email @@ -677,7 +679,7 @@ This is the kind of questions you can answer with the simplest consolidation. Indeed, the program can be used to aggregate the report results. -Operations to perform +**Operations to perform** The consolidation process is working on the xml files generated by the consolidation report. By default, the files are picked in the directory @@ -699,7 +701,7 @@ PingCastle --hc-conso 4. This report is generated automatically when the healthcheck is performed with the server "\*" -Consolidation report +**Consolidation report** The consolidation report is a concatenation of all data contained in the report, without the detail. It follows the same plan than a simple @@ -709,7 +711,7 @@ report. When the consolidation is made, 3 html files are generated. -File ad_hc_summary.html +**File ad_hc_summary.html** The first one contains the summary of all the reports: It keeps the same structure than the detailed reports but with a higher level of detail. @@ -739,7 +741,7 @@ a scanner description is shown. ![](/img/product_docs/pingcastle/basicuser/image29.png) -Here are the main scanners +**Here are the main scanners** Check for specific user in global permissions @@ -751,7 +753,7 @@ objects on a domain. It is default to the \"authenticated users\", PingCastle --scanner aclcheck --server ``` -Local administrators +**Local administrators** The local administrator accounts can be used in an attack to recover passwords in memory with tools like mimikatz. You can enumerate most of @@ -761,7 +763,7 @@ them without any privilege with PingCastle with the following command: PingCastle --scanner localadmin --server ``` -Local shares +**Local shares** Local shares can be opened to everyone and be storing confidential information like login and passwords or backups. PingCastle can do a @@ -772,7 +774,7 @@ following command: PingCastle --scanner share --server ``` -Start time +**Start time** Any authenticated users can get the start time of a computer in the domain and even unauthenticated ones if SMB v2 is activated. PingCastle @@ -783,7 +785,7 @@ all computers of the domain: PingCastle --scanner startup --server ``` -SMB version +**SMB version** PingCastle can do a quick scan without any privilege to know which version is supported as server for each computer of a domain: @@ -792,7 +794,7 @@ version is supported as server for each computer of a domain: PingCastle --scanner smb --server ``` -Null sessions +**Null sessions** Null sessions are an old Windows NT4 problem. It should have been disappears but is still present on 20-30% of the domains. When it is @@ -808,7 +810,7 @@ using this functionality. Run the following command: PingCastle --scanner nullsession --server ``` -foreignusers +**foreignusers** A inbound trust ( an unidirectional trust) is understood as a diode. Nothing is supposed to be extracted. But this is not true. PingCastle @@ -828,11 +830,11 @@ PingCastle --scanner foreignusers --foreigndomain --serve # Annex -Command line reference +**Command line reference** Here is a short description of the main tasks performed by the program. -Health check +**Health check** run the health check : @@ -913,14 +915,14 @@ switch: ``` --help : display this message ---interactive : force the interactive mode +**--interactive : force the interactive mode** --log : generate a log file --log-console : add log to the console ``` -Common options when connecting to the AD +**Common options when connecting to the AD** ``` --server : use this server (default: current domain @@ -939,11 +941,11 @@ prompt) --protocol : selection the protocol to use among LDAP or ADWS (fastest) -: ADWSThenLDAP (default), ADWSOnly, LDAPOnly, LDAPThenADWS +**: ADWSThenLDAP (default), ADWSOnly, LDAPOnly, LDAPThenADWS** --carto : perform a quick cartography with domains surrounding ---healthcheck : perform the healthcheck (step1) +**--healthcheck : perform the healthcheck (step1)** --api-endpoint <> : upload report via api call eg: http://server @@ -955,7 +957,7 @@ hc on all trusted domains except domains of the forest and forest trusts --explore-forest-trust : on root domain of a forest, after the healthcheck, do the hc on all forest trusts discovered ---explore-trust and --explore-forest-trust can be run together +**--explore-trust and --explore-forest-trust can be run together** --explore-exception : comma separated values of domains that will not be explored automatically @@ -965,7 +967,7 @@ content of the xml report --level : specify the amount of data found in the xml file -: level: Full, Normal, Light +**: level: Full, Normal, Light** --no-enum-limit : remove the max 100 users limitation in html report @@ -974,7 +976,7 @@ content of the xml report --sendXmlTo : send xml reports to a mailbox (comma separated email) ---sendHtmlTo : send html reports to a mailbox +**--sendHtmlTo : send html reports to a mailbox** --sendAllTo : send html reports to a mailbox @@ -988,11 +990,11 @@ received --smtptls : enable TLS/SSL in SMTP if used on other port than 465 and 587 ---skip-null-session: do not test for null session +**--skip-null-session: do not test for null session** --webdirectory : upload the xml report to a webdav server ---webuser : optional user and password +**--webuser : optional user and password** --webpassword @@ -1002,11 +1004,11 @@ Do not forget PingCastleReporting includes a similar option but for --generate-key : generate and display a new RSA key for encryption ---hc-conso : consolidate multiple healthcheck xml reports (step2) +**--hc-conso : consolidate multiple healthcheck xml reports (step2)** --center-on : center the simplified graph on this domain -default is the domain with the most links +**default is the domain with the most links** --xmls : specify the path containing xml (default: current directory) @@ -1021,7 +1023,7 @@ any healthcheck switches (send email, ..) can be reused --level : specify the amount of data found in the xml file -: level: Full, Normal, Light (default: Normal) +**: level: Full, Normal, Light (default: Normal)** --encrypt : use an RSA key stored in the .config file to crypt the content of the xml report @@ -1041,68 +1043,68 @@ content of the xml report --node : create a report based on a object -: example: "cn=name" or "name" +**: example: "cn=name" or "name"** --nodes : create x report based on the nodes listed on a file --scanner : perform a scan on one of all computers of the domain (using --server) -aclcheck +**aclcheck** Check authorization related to users or groups. Default to everyone, authenticated users and domain users -antivirus +**antivirus** Check for computers without known antivirus installed. It is used to detect unprotected computers but may also report computers with unknown antivirus. -corruptADDatabase +**corruptADDatabase** Try to detect corrupted AD database. To run only when requested by PingCastle support. -foreignusers +**foreignusers** Use trusts to enumerate users located in domain denied such as bastion or domains too far away. -laps_bitlocker +**laps_bitlocker** Check on the AD if LAPS and/or BitLocker has been enabled for all computers on the domain. -localadmin +**localadmin** Enumerate the local administrators of a computer. -nullsession +**nullsession** Check if null sessions are enabled and provide example(s). -nullsession-trust +**nullsession-trust** Dump the trusts of a domain via null session if possible -share +**share** List all shares published on a computer and determine if the share can be accessed by anyone -smb +**smb** Scan a computer and determine the smb version available. Also if SMB signing is active. -spooler +**spooler** Check if the spooler service is remotely active. The spooler can be abused to get computer tokens when unconstrained delegations are exploited. -startup +**startup** Get the last startup date of a computer. Can be used to determine if latest patches have been applied. @@ -1117,7 +1119,7 @@ options for scanners: --foreigndomain : foreign domain targeted using its FQDN or sids -Example of SID: S-1-5-21-4005144719-3948538632-2546531719 +**Example of SID: S-1-5-21-4005144719-3948538632-2546531719** --upload-all-reports: use the API to upload all reports in the current directory @@ -1125,10 +1127,13 @@ directory --api-endpoint <> : upload report via api call eg: http://server --api-key : and using the api key as registered +``` -Note: do not forget to set --level Full to send all the information +:::note +Do not forget to set --level Full to send all the information available -``` +::: + ## List of open source software used @@ -1186,7 +1191,7 @@ This can be modified in the security policies: ![](/img/product_docs/pingcastle/basicuser/image37.png) -Select \"Local Policies\" in MSC snap in +**Select \"Local Policies\" in MSC snap in** Select \"User Rights Assignment\" diff --git a/docs/pingcastle/3.3/proinstall.md b/docs/pingcastle/3.3/proinstall.md index d7f6b99f35..aab74f7582 100644 --- a/docs/pingcastle/3.3/proinstall.md +++ b/docs/pingcastle/3.3/proinstall.md @@ -11,7 +11,7 @@ improving over time. # Requirements -System Specifications +**System Specifications** The Operating systems supported are: @@ -76,7 +76,7 @@ domains include subdomains of a forest. 2. The number of Domain Controllers are not used for licensing, only domains. -Example +**Example** If you have consto.com with two subdomains called uk.consto.com and us.consto.com, then you would require three licenses. @@ -107,7 +107,7 @@ it in the database. Add the end of the procedure, you will get "Tenant ID" and "Client ID". -Connect to \"Azure Portal\" located at https://portal.azure.com +**Connect to \"Azure Portal\" located at https://portal.azure.com** ![](/img/product_docs/pingcastle/proinstall/image4.png) @@ -138,8 +138,10 @@ ClientID and TenantID and keep it with you. ![Une image contenant texte Description générée automatiquement](/img/product_docs/pingcastle/proinstall/image9.png) -Note: the permission can be granted implicitly by the first user +:::note +The permission can be granted implicitly by the first user connecting to the application. +::: # SQL Express installation @@ -148,7 +150,7 @@ any edition of SQL Server is working. Download SQL Express 2019 here: -https://www.microsoft.com/en-us/Download/details.aspx?id=101064 +**https://www.microsoft.com/en-us/Download/details.aspx?id=101064** Select "Basic"and let the installation proceed. @@ -386,7 +388,9 @@ sudo apt-get install postgresql postgresql-contrib sudo /etc/init.d/postgresql start ``` -Note: by default no password for the user postgres +:::note +By default no password for the user postgres +::: ```bash sudo -u postgres createuser pingcastle @@ -401,7 +405,7 @@ sudo -u postgres createdb -O pingcastle pingcastle ## Using a Database hosted on another server -Configure SQL Server with a local DB account +**Configure SQL Server with a local DB account** You first need to create a local account inside Sql Server. @@ -419,7 +423,7 @@ Then create a database. ![](/img/product_docs/pingcastle/proinstall/image37.png) -Then create a database +**Then create a database** ![](/img/product_docs/pingcastle/proinstall/image38.png) @@ -458,7 +462,7 @@ need to be escaped as they are located inside a json string. ![Une image contenant texte, Police, nombre, logiciel Description générée automatiquement](/img/product_docs/pingcastle/proinstall/image43.png) -Configure SQL Server with an Active Directory user +**Configure SQL Server with an Active Directory user** You need to first create this Windows user. @@ -527,13 +531,13 @@ For the license, the parameter is stored in the \"License\" setting. Here are some connection string examples: -Sql Local DB +**Sql Local DB** ```json "Server=(localdb)\\mssqllocaldb;Database=aspnet-PingCastlePro-9521AD04-BA3A-41DC-A454-F2BD464E9391;Trusted_Connection=True;MultipleActiveResultSets=true" ``` -PostGres +**PostGres** ```json "DefaultConnection": "Server=localhost;username=pingcastle;password=pingcastle;database=pingcastle" @@ -581,7 +585,7 @@ Azure. ![](/img/product_docs/pingcastle/proinstall/image51.png) -It then display the welcome screen +**It then display the welcome screen** ![](/img/product_docs/pingcastle/proinstall/image52.png) @@ -623,7 +627,7 @@ pingcastle.exe --upload-all-reports --api-endpoint https://endpoint.com --api-ke # Post Installation - Scheduler -Quick installation +**Quick installation** PingCastle allows the possibility to the administrator of the application to schedule scans. It is useful when the solution is @@ -656,9 +660,11 @@ the access to the task scheduler cannot be delegated. ## Custom installation -Note: PingCastle is using behing the hood a folder named "PingCastle" in +:::note +PingCastle is using behing the hood a folder named "PingCastle" in the task scheduler. We will use the COM api as it exposes the security descriptor -- which is not the case of the native PowerShell APIL +::: If you want PingCastle to be able to start or stop tasks but not being able to edit them (it requires that the account is local admin), you @@ -725,7 +731,7 @@ scheduler. The recommended frequency is every week, using a normal user account (not privileged) running on a batch server (not a DC). -Command +**Command** You need to create an API key with the upload right (the \"Agent\" page as admin). @@ -756,7 +762,7 @@ The method to run the application manually is to run the command: dotnet.exe PingCastlePro.dll ``` -(dotnet.exe is stored by default on c:\\program files\\dotnet) +**(dotnet.exe is stored by default on c:\\program files\\dotnet)** Additionnally, you can choose to open the application on the network by specifying the \--server.urls parameter: @@ -772,7 +778,7 @@ service connect under IIS APPPool\\AppName. We recommend to look at the following page to grant right to the application pool account on Sql Server: -https://blogs.msdn.microsoft.com/ericparvin/2015/04/14/how-to-add-the-applicationpoolidentity-to-a-sql-server-login +**https://blogs.msdn.microsoft.com/ericparvin/2015/04/14/how-to-add-the-applicationpoolidentity-to-a-sql-server-login** Then depending on the platform additional logs can be stored. @@ -815,7 +821,9 @@ And the message when running on the command line: identify the correct version of the framework and install it. Do not forget to install the IIS middleware is you are installing on IIS. -Note: the last error was related to the missing KB KB2533623 +:::note +The last error was related to the missing KB KB2533623 +::: ## Error at the application startup @@ -911,7 +919,7 @@ Follow the steps to enable debug logging. 5. From the same directory, open the **web.config** file and edit the **aspNetCore** tag so **stdoutLogEnabled=true**. -Example +**Example** ```xml diff --git a/docs/pingcastle/3.3/proupgrade.md b/docs/pingcastle/3.3/proupgrade.md index c300171a09..79ff0ec5cc 100644 --- a/docs/pingcastle/3.3/proupgrade.md +++ b/docs/pingcastle/3.3/proupgrade.md @@ -2,7 +2,7 @@ ## Before proceeding to the upgrade -Version check +**Version check** You can check the existing version using the About link at the bottom of each page. diff --git a/docs/pingcastle/3.3/prouser.md b/docs/pingcastle/3.3/prouser.md index 16a09535e5..a968168aa6 100644 --- a/docs/pingcastle/3.3/prouser.md +++ b/docs/pingcastle/3.3/prouser.md @@ -60,7 +60,7 @@ PingCastle Pro provides authentication through: # Ping Castle Pro features -Main pages overview +**Main pages overview** The application is divided is 2 different areas: @@ -78,7 +78,7 @@ and its data. ## Domains -Detail information on a domain +**Detail information on a domain** This view displays detailed information on the domain, as well as many other information such the results of the last report, some history, @@ -149,7 +149,7 @@ perimeter. ![](/img/product_docs/pingcastle/prouser/image9.png) -Rule exceptions +**Rule exceptions** \"Rule exceptions\" can be set in order to completely disable a rule within a specific domain. It means that this rule will not be applied @@ -159,7 +159,7 @@ your organization. Do not hesitate to contact the PingCastle editors if you have doubts or require extra assistance regarding how the exceptions are managed. -Migration +**Migration** In the same idea you can set exceptions for specific domain, you can inform it in the application when one of your domains is migrating. It @@ -225,8 +225,10 @@ pingcastle --healthcheck --api-endpoint --api-key ![](/img/product_docs/pingcastle/prouser/image14.png) -Important note: By default, all detailed information will be filtered. -To avoid this behavior, the command line can to be changed to: +:::note +By default, all detailed information will be filtered. +To avoid this behavior, the command line can to be changed as follows. +::: ```bash pingcastle --healthcheck --api-endpoint --api-key --level Full From f98b763c7138c28755476a9a7d0993ac37e354d0 Mon Sep 17 00:00:00 2001 From: sreeparnas Date: Thu, 17 Jul 2025 13:07:33 +0100 Subject: [PATCH 2/2] Apply suggestions from code review Commit changes accepted Co-authored-by: stuart-jaeckel-netwrix --- docs/pingcastle/3.3/enterpriseinstall.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/pingcastle/3.3/enterpriseinstall.md b/docs/pingcastle/3.3/enterpriseinstall.md index 3bdec92645..557af9fb89 100644 --- a/docs/pingcastle/3.3/enterpriseinstall.md +++ b/docs/pingcastle/3.3/enterpriseinstall.md @@ -242,21 +242,21 @@ the following actions as admin in powershell: ```powershell # connect to the task scheduler service -**$scheduleObject = New-Object -ComObject schedule.service** +$scheduleObject = New-Object -ComObject schedule.service $scheduleObject.connect() -**$rootFolder = $scheduleObject.GetFolder("")** +$rootFolder = $scheduleObject.GetFolder("") $PingCastleFolder = $rootFolder.GetFolder("PingCastle") -**$PingCastleFolder.GetTasks(1) | Foreach-Object {** +$PingCastleFolder.GetTasks(1) | Foreach-Object { $sddl = $_.GetSecurityDescriptor(1+2+4+8) # add full control to the task -**$sddl += "(A;S-1-XXX-XXX-XXX;FA;;;SY)"** +$sddl += "(A;S-1-XXX-XXX-XXX;FA;;;SY)" $_.SetSecurityDescriptor($sddl, 0) @@ -352,13 +352,13 @@ The following SQL can grant these permissions: ```sql If not Exists (select loginname from master.dbo.syslogins -**where loginname = 'IIS APPPOOL\PingCastleEnterprise')** +where loginname = 'IIS APPPOOL\PingCastleEnterprise') Begin CREATE LOGIN [IIS APPPOOL\PingCastleEnterprise] FROM WINDOWS; -**End** +End use PingCastleEnterprise; @@ -673,11 +673,11 @@ to the following one: ```json "OpenIdConnect": { -**"DisplayName": "AzureAD",** +"DisplayName": "AzureAD", "ClientId": "", -**"Authority": "https://login.microsoftonline.com//",** +"Authority": "https://login.microsoftonline.com//", } ``` @@ -814,7 +814,7 @@ When using ADFS, the well known configuration is: ```json "Saml2": { -**"Issuer": "https://xxx/Saml2/Login",** +"Issuer": "https://xxx/Saml2/Login", "IdPMetadata": "https://xxx/FederationMetadata/2007-06/FederationMetadata.xml"