GroupProbe calls WindowsCommon::ExpandGroup()->WindowsCommon::GetLocalGroupMembers(), and WindowsCommon::GetLocalGroupMembers() splits off the domain and ignores it, so you could put anything you want as a domain for a builtin group, and it would work. I tried "foo\Users" and it produced an item with that as the group name. The group object entity is then just copied over to the item entity.
The domain name needs to actually be checked, and the object entity values should not just be copied over to the item entities. The operation has to actually be satisfied.
Log in to post a comment.