Add support for gpo tasks that are wrapped in other tasks (#298)

fox-it · Jul 5, 2023 · 51a8107 · 51a8107
1 parent 73213e1
commit 51a8107
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/dissect/target/plugins/os/windows/adpolicy.py b/dissect/target/plugins/os/windows/adpolicy.py
@@ -69,16 +69,16 @@ def _xmltasks(self, policy_dir):
                 task_file_stat = task_file.stat()
                 xml = task_file.read_text()
                 tree = ElementTree.fromstring(xml)
-                for task in tree.findall("Task"):
-                    properties = task.find("Properties")
+                for task in tree.findall(".//{*}Task"):
+                    properties = task.find("Properties") or task
                     task_data = ElementTree.tostring(task)
                     yield ADPolicyRecord(
                         last_modification_time=task_file_stat.st_mtime,
                         last_access_time=task_file_stat.st_atime,
                         creation_time=task_file_stat.st_ctime,
                         guid=task.attrib.get("uid"),
                         key="XML",
-                        value=properties.attrib.get("appName"),
+                        value=properties.attrib.get("appName", None),
                         size=len(task_data),
                         data=task_data,
                         path=task_file,