Skip to content

Commit

Permalink
Changes for Windows user account without profile log2timeline#4891
Browse files Browse the repository at this point in the history
  • Loading branch information
joachimmetz committed Jul 15, 2024
1 parent 903805c commit 1adc9be
Showing 1 changed file with 8 additions and 8 deletions.
16 changes: 8 additions & 8 deletions plaso/preprocessors/windows.py
Original file line number Diff line number Diff line change
Expand Up @@ -902,25 +902,25 @@ def _ParseKey(self, mediator, registry_key, value_name):
user_account = artifacts.UserAccountArtifact(
identifier=registry_key.name, path_separator='\\')

# It has been observed that Azure Entra ID useraccount entries do not
# contain ProfileImagePath value.

username = None

registry_value = registry_key.GetValueByName('ProfileImagePath')
if registry_value:
profile_path = registry_value.GetDataAsObject()

username = self._GetUsernameFromProfilePath(profile_path)
if profile_path and not username:
mediator.ProducePreprocessingWarning(self.ARTIFACT_DEFINITION_NAME, (
f'Unable to determine username from profile path: '
f'"{profile_path!s}"'))

user_account.user_directory = profile_path or None
user_account.username = username or None

try:
mediator.AddUserAccount(user_account)
except KeyError:
mediator.ProducePreprocessingWarning(
self.ARTIFACT_DEFINITION_NAME,
f'Unable to add user account: "{username!s}" to knowledge base')
mediator.ProducePreprocessingWarning(self.ARTIFACT_DEFINITION_NAME, (
f'Unable to add user account: "{user_account.identifier:s}" to '
f'knowledge base'))


class WindowsWinDirEnvironmentVariablePlugin(
Expand Down

0 comments on commit 1adc9be

Please sign in to comment.