Release Notes - PingCastle 4.1.2.0

This release adds new detection rules, a new command line option and wider Group Policy discovery. It also hardens the AutoUpdater against tampered packages and fixes several false positives and usability issues.

New detection rules

• Fake password change detection. Detects accounts whose pwdLastSet was refreshed, for example by switching "User must change password at next logon" on and off, without the password really changing. This hid stale or compromised credentials from password-age checks. There is one rule for all users, rated maturity level 4, and one for privileged admins, rated maturity level 2.
• SPN Unicode collision (KerberLoss, CVE-2026-25177). Detects Service Principal Names containing invisible Unicode characters, such as zero-width or directional marks. These bypass Active Directory's SPN uniqueness check and can enable Kerberos-to-NTLM downgrade and delegation-hijack attacks.
• Delegation to the KRBTGT account (P-DelegationKrbtgt). Detects user or computer accounts set up with constrained delegation to the krbtgt service. An attacker can use this to get the equivalent of a TGT for any user, creating a persistence backdoor that survives krbtgt password rotation.
• DNSHostName mismatch (A-DnsHostnameMismatch). Flags enabled computer accounts whose dNSHostName host label does not match sAMAccountName (ignoring the trailing $). This mismatch is the artefact of the Certifried vulnerability (CVE-2022-26923), where AD CS issues certificates from dNSHostName while Kerberos trusts sAMAccountName.
• UPN and SAMAccountName collision (A-UpnSamCollision, CVE-2026-27912). Detects accounts whose User Principal Name matches another account's SAM Account Name. This collision can be exploited to reset the password of any account, including Domain Admins.

New features and improvements

• New --skip-ldap-signing option for PingCastle.exe. Skips the plain LDAP (port 389) connection made to each domain controller to test the LDAP signing requirement. Use it where EDR or monitoring tools alert on that probe. It works like --skip-dc-rpc, behaviour is unchanged without the flag, and --help lists it.
• Wider Group Policy discovery. GPOs linked from trusted domains, parent domains and forest roots are now resolved. Before, only GPOs in the scanned domain's Policies container and SYSVOL were found, so remotely stored GPOs were descoped.
• Computers export includes an "Enabled" column.
• Spelling and grammar corrections in product text.

Security

• .NET runtime and packages updated to .NET 10.0.10 and the latest .NET 10 Entity Framework Core packages, to pick up vulnerability fixes.
• This release also includes the previous vulnerability fixes that were fixed in 4.0.0.31 and 4.0.0.33

Bug fixes

• "Microsoft Entra Kerberos" trust false positive. Microsoft Entra Kerberos trusts are no longer reported by the inactive trust finding (T-Inactive).
• S-AesNotEnabled detail. The rule now lists each affected account with its supported encryption types, so a single false-positive account, such as an Entra krbtgt account, can be identified and handled without disabling the whole rule.
• Report text copying. Risk accordion header text in reports can now be selected and copied.