PingCastle 4.0.0.20

PingCastle Release Notes

Improvements & Bug Fixes

ID	Title	Type	Escalation #	Summary
426905	DCCoerce anomaly rule crash	Bug	—	Fixed a crash in the DCCoerce anomaly rule that occurred when checking a GPO's applied scope.
432375	Protected Users group truncated at 1500 members	Bug	—	Fixed an issue where privileged-group checks (including Protected Users) silently stopped counting past the 1500th member, causing admins beyond that threshold to be missed.
433486	Duplicate DC crash in report generation	Bug	—	Fixed a crash in the domain controller audit check when two DCs shared the same distinguished name.
435500	BUILTIN\Users exclusion not applied in Everyone membership check	Bug	—	Fixed the Everyone-group membership rule so its BUILTIN\Users exclusion actually takes effect, removing false-positive findings.
435947	Disabled accounts inflating AES-not-enabled risk score	Bug	—	Disabled accounts are no longer counted toward the S-AESNotEnabled risk score, since they can't be Kerberoasted or AS-REP roasted.
438279	Duplicate DC crash in fake-report generation	Bug	—	Fixed a crash in fake-report generation caused by generated domain controllers sharing an identical distinguished name; each is now assigned a unique DN.
438484	False-positive malware detection by Microsoft Defender	Bug	—	Replaced the hotfix-detection method to resolve a Defender false positive, and corrected related false positives in the MS17-010/MS14-068 checks.
439501	Hotfix scanner false positives on patched systems	Bug	—	Fixed false positives in the MS17-010/MS14-068 vulnerability checks on patched systems, including Server 2012, via more reliable date parsing and broader update coverage.
439625	HoneyPot accounts not excluded from privileged-service findings	Bug	—	Fixed privileged-group rules (including Domain Admin service accounts) to correctly exclude HoneyPot accounts as configured.
445169	Constrained delegation rule never triggered	Bug	—	Fixed the constrained-delegation-on-DC rule so it correctly detects accounts with plain constrained delegation configured.
—	JSON export for healthcheck reports	Bug	—	Added a --json export option for healthcheck reports, alongside the existing XML output.
—	CLI help text typo	Bug	—	Corrected a typo in the CLI help/key-generation text.

GitHub Contributors

Thanks to the community for this release:

• Sacha Athias — added JSON export support for healthcheck reports (#343 ), resolving #342

PingCastle 3.5.1.33

What's Changed

• Removed CIM-based Hotfix scanner to avoid detections from Windows Defender
• Enhanced the Hotfix scanner to correctly detect installed KBs as previous list was not sufficient.

Full Changelog: 3.5.1.31...3.5.1.33

PingCastle 3.5.1.31

Release Notes

• Certificate template checks now allow domain computers to trigger regardless of whether msds-machineaccountquota is set, delivering more comprehensive coverage of certificate authentication configurations across varied domain setups
• Enhanced P-AdminLogin check to include password reset logic, improving detection and reporting of admin accounts with outdated or concerning password patterns
• Added MFA status column to Entra ID reporting
• Restored honeypot exclusion functionality
• Corrected a typo in the LDAP filter affecting BuiltinDomain detection
• Updated documentation links to the external STIG viewer resource which were pointing to invalid URLs
• Fixed detection for MS17-010 (EternalBlue) vulnerability on domain controllers which was previously being reported incorrectly
• Enhanced the PWDNeverExpires check to properly evaluate accounts that have had their password changed recently, reducing false positives
• Clarified delegation reporting in computer analysis to reduce confusion around constrained and unconstrained delegation results
• Optimized knowledge base scanning performance during compute risks evaluation
• Fixed S-AesNotEnabled scoring issues
  • Disabled accounts are now excluded from the risk count as they cannot be AS-REP Roasted
  • Updated information and guidance based on the Microsoft RC4 phase-out
• Fixed configuration file parsing so that settings in appsettings.console.json are correctly loaded at runtime
• Fixed a string mismatch in the exclusion logic that was preventing BUILTIN\Users from being correctly excluded from the A-MembershipEveryone risk assessment
• Rewrote the auto-updater mechanism after versions 3.5.0.37+ were found to corrupt configuration files on affected servers

PingCastle 3.5.0.44

Fixed an issue where the --user and --password parameters would not work for authentication form standalone machines or from a domain joined machine to another domain.

PingCastle 3.5.0.40

Release Notes

• Fixed Export computers and users options not being possible
  • Fixed the outputs in both User and Computer reports to show better data
    • LAPS attributes now only shows in computers
    • BadPrimaryGroup issue resolved and header updated to be clear about it only working for enabled users (this is because this is how the risk works)
• Fixed False positive from AzureADKrrberos Objects and our new updated HotFix scanner not excluding them
• Fixed regression in the bad primary group rule to not report on disabled accounts. This was a mix up between the Export and the Rule.
• Fixed an issue with A-DCLAPSign where mitigated Domain Controllers were incorrectly detected due to a change made when upgrading ASP.NET 8. New methodology implemented and code comments and trace logs improved.
• Entra ID Scan issue with users whose “Account needs to be secured” (MFA requirement with no MFA) from erroring and now falls back to the previous error saying to use a different browser
• Fixed an issue in privileged mode where the CA Scan could error if the CA registry location is in an unexpected location.
• Fixed an issue with the TenantID Column in Entra reports where it outputted the entire URL
• Updated P-UnconstrainedDelegation to capture disabled accounts as they are a significant risk still and updated the risk text.
• Fixed an issue with the “You are not using a supported version of PingCastle” banner on all reports
• PingCastle AutoUpdater Migration from pingcastle.exe.config to appsettings.console.json now triggers every time.

Packaging Update: Removed the old documentation pdf from the zip. Documentation is located here.

PingCastle 3.5.0.37

Release Notes

Privileged Mode Updates

• S-Vuln-MS14-068
• S-Vuln-MS17-010
  • Detection now checks installed hotfixes on domain controllers.

Without Privileged Mode, these rules will no longer be evaluated.

---

Rule Updates & Fixes

DNS Zone Rules

A-DnsZoneUpdate1 & A-DnsZoneUpdate2

• _msdcs.* zones are now classified as critical infrastructure

• Reporting has been expanded to include:

  • Zone name
  • Domain
  • Distinguished Name
  • Partition

This makes DNS details clearer and simplifies remediation planning.

---

P-Kerberoasting

• Fixed duplicate findings when users belonged to multiple privileged groups making findings more focused.

• The report now shows:

  • One row per vulnerable user
  • All associated groups and SPNs aggregated

---

T-SIDFiltering

• Fixed false positives on legacy Windows 2000 intra-forest trusts
• These trusts often have TrustAttributes = 0 due to historical domain upgrades
• New CrossRef-based filtering logic correctly identifies within-forest trusts and no longer flags them as insecure

---

Microsoft Defender Attack Surface Reduction (ASR)

• Microsoft changed ASR policy locations in Windows Server 2025
• PingCastle now checks all three possible GPO paths
• Ensures reliable ASR detection across mixed server versions

---

Other Rule Fixes

• A-DnsZoneAUCreateChild

  • Fixed false negatives when no DNS partitions exist on a domain controller
  • Previously, some environments were skipped entirely due to an unreachable code path

• S-FolderOptions

  • Remediation guidance now points to the correct GPO path

---

Platform Update: ASP.NET 8 Upgrade

PingCastle has been upgraded to ASP.NET 8 to align with PingCastle Enterprise and to hopefully reduce antivirus false-positive detections seen in some environments over the last few months.

What to expect

• Larger executable (~200 MB)

  • ASP.NET 8 is bundled directly into the executable to keep execution simple.
  • No external runtime dependencies required

• Configuration file change

  • Configuration moves from PingCastle.exe.config To: appsettings.console.json

• Auto-update behavior change

  • If you use the PingCastleAutoUpdater.exe, two executions are required:

    1. First run: Downloads the new version
    2. Second run: Automatically migrates existing configuration to appsettings.console.json

Update (February 5, 2026)
It was identified that PingCastle released with unsigned binaries due to a sequencing issue in the build and release pipelines. Due to that the release version has been updated from 3.5.0.33 to 3.5.0.37. No code changes were made between these versions, only build and release pipeline changes were made.

PingCastle 3.4.2.66

Release Date: 2025-10-06
End of support: 2026-04-30

Release Notes

ESC2 Check Updates

• Privileged Mode: Added support to validate enrollment permissions on the Certification Authority.
• Clearer Messaging: Risk identification for ESC2 is now explicit.
• Expanded Guidance: Improved technical explanations and remediation details.

Bug Fixes

• Exit Option: Fixed behavior to return one level up instead of terminating the program.
• SMB2SignatureNotEnabled: Corrected handling of invalid SMB2_NegotiateResponse structures.
• LAPS Charts: Resolved incorrect data display in pie charts.
• Non-Domain Runs: Fixed issues running PingCastle on non-domain-joined machines.
• Help Output: Added missing --services collection option to the help text.

Entra ID Terminology

• Standardized terminology to align with Microsoft Entra ID, replacing legacy Azure AD terms.

DNS Zone Update Improvements

• Added DistinguishedName property to HealthcheckDnsZones.
• LDAP collection now includes DNs for (objectClass=dnsZone) objects.
• Filters CNF and replication artifacts.
• AddRawDetail outputs include DN and partition context for better precision.

Update
2025-10-16: Fixed zip layout for PingCastleAutoUpdater.exe

PingCastle 3.4.1.38

Release Date: 2025-07-11
End of support: 2026-01-10

PingCastle 3.4.1.35

Release Date: 2025-07-11
End of support: 2026-01-10

PingCastle 3.3.0.12

Release date: 2025-05-08
End of support: 2026-01-31