PingCastle Release Notes
Improvements & Bug Fixes
| ID | Title | Type | Escalation # | Summary |
|---|---|---|---|---|
| 426905 | DCCoerce anomaly rule crash | Bug | — | Fixed a crash in the DCCoerce anomaly rule that occurred when checking a GPO's applied scope. |
| 432375 | Protected Users group truncated at 1500 members | Bug | — | Fixed an issue where privileged-group checks (including Protected Users) silently stopped counting past the 1500th member, causing admins beyond that threshold to be missed. |
| 433486 | Duplicate DC crash in report generation | Bug | — | Fixed a crash in the domain controller audit check when two DCs shared the same distinguished name. |
| 435500 | BUILTIN\Users exclusion not applied in Everyone membership check | Bug | — | Fixed the Everyone-group membership rule so its BUILTIN\Users exclusion actually takes effect, removing false-positive findings. |
| 435947 | Disabled accounts inflating AES-not-enabled risk score | Bug | — | Disabled accounts are no longer counted toward the S-AESNotEnabled risk score, since they can't be Kerberoasted or AS-REP roasted. |
| 438279 | Duplicate DC crash in fake-report generation | Bug | — | Fixed a crash in fake-report generation caused by generated domain controllers sharing an identical distinguished name; each is now assigned a unique DN. |
| 438484 | False-positive malware detection by Microsoft Defender | Bug | — | Replaced the hotfix-detection method to resolve a Defender false positive, and corrected related false positives in the MS17-010/MS14-068 checks. |
| 439501 | Hotfix scanner false positives on patched systems | Bug | — | Fixed false positives in the MS17-010/MS14-068 vulnerability checks on patched systems, including Server 2012, via more reliable date parsing and broader update coverage. |
| 439625 | HoneyPot accounts not excluded from privileged-service findings | Bug | — | Fixed privileged-group rules (including Domain Admin service accounts) to correctly exclude HoneyPot accounts as configured. |
| 445169 | Constrained delegation rule never triggered | Bug | — | Fixed the constrained-delegation-on-DC rule so it correctly detects accounts with plain constrained delegation configured. |
| — | JSON export for healthcheck reports | Bug | — | Added a --json export option for healthcheck reports, alongside the existing XML output. |
| — | CLI help text typo | Bug | — | Corrected a typo in the CLI help/key-generation text. |
GitHub Contributors
Thanks to the community for this release: