diff --git a/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java b/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java
index 00d0a82cfab022fe974a14d2149db1edbd66aab4..271c7f5fcfa6f9ff0320e072dddc4abb4a9f9b5f 100755
--- a/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/OsAccountManager.java
@@ -41,6 +41,8 @@
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbConnection;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
import org.sleuthkit.datamodel.TskEvent.OsAccountsUpdatedTskEvent;
+import static org.sleuthkit.datamodel.WindowsAccountUtils.getWindowsSpecialSidName;
+import static org.sleuthkit.datamodel.WindowsAccountUtils.isWindowsSpecialSid;
/**
* Responsible for creating/updating/retrieving the OS accounts for files and
@@ -213,6 +215,17 @@ public OsAccount newWindowsOsAccount(String sid, String loginName, OsAccountReal
// try to create account
try {
OsAccount account = newOsAccount(sid, loginName, realm, OsAccount.OsAccountStatus.UNKNOWN, trans);
+
+ // If the SID indicates a special windows account, then set its full name.
+ if (!StringUtils.isBlank(sid) && isWindowsSpecialSid(sid)) {
+ String fullName = getWindowsSpecialSidName(sid);
+ if (StringUtils.isNotBlank(fullName)) {
+ OsAccountUpdateResult updateResult = updateStandardOsAccountAttributes(account, fullName, null, null, null, trans);
+ if (updateResult.getUpdatedAccount().isPresent()) {
+ account = updateResult.getUpdatedAccount().get();
+ }
+ }
+ }
trans.commit();
trans = null;
return account;
diff --git a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
index 102a73e22859a6a5231e174627df960a3f818df4..28dbb1b017152156d9a2f762a3d48b972bb2b3bc 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/WindowsAccountUtils.java
@@ -18,7 +18,12 @@
*/
package org.sleuthkit.datamodel;
+import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Optional;
import java.util.Set;
/**
@@ -72,7 +77,8 @@ final class WindowsAccountUtils {
// Any SIDs with the following prefixes are group SID and should be excluded.
private static final Set<String> GROUP_SID_PREFIX = ImmutableSet.of(
- "S-1-5-32" // Builtin
+ "S-1-5-32", // Builtin
+ "S-1-5-87" // Task ID prefix
);
@@ -110,20 +116,21 @@ final class WindowsAccountUtils {
// Some windows SID indicate special account.
// These should be handled differently from regular user accounts.
- private static final Set<String> SPECIAL_SIDS = ImmutableSet.of(
- "S-1-5-18", // LOCAL_SYSTEM_ACCOUNT
- "S-1-5-19", // LOCAL_SERVICE_ACCOUNT
- "S-1-5-20" // NETWORK_SERVICE_ACCOUNT
- );
- private static final Set<String> SPECIAL_SID_PREFIXES = ImmutableSet.of(
- "S-1-5-80", // Virtual Service accounts
- "S-1-5-82", // AppPoolIdentity Virtual accounts.
- "S-1-5-83", // Virtual Machine Virtual Accounts.
- "S-1-5-90", // Windows Manager Virtual Accounts.
- "S-1-5-96" // Font Drive Host Virtual Accounts.
- );
-
-
+ private static final Map<String, String> SPECIAL_SIDS_MAP = ImmutableMap.<String, String>builder()
+ .put("S-1-5-18", "Local System Account")
+ .put("S-1-5-19", "Local Service Account")
+ .put("S-1-5-20", "Network Service Account")
+ .build();
+
+ private static final Map<String, String> SPECIAL_SID_PREFIXES_MAP = ImmutableMap.<String, String>builder()
+ .put("S-1-5-80", "Service Virtual Account")
+ .put("S-1-5-82", "IIS AppPool Virtual Account")
+ .put("S-1-5-83", "Virtual Machine Virtual Account")
+ .put("S-1-5-90", "Window Manager Virtual Account")
+ .put("S-1-5-94", "WinRM Virtual accountt")
+ .put("S-1-5-96", "Font Driver Host Virtual Account")
+ .build();
+
/**
* Checks if the given SID is a special Windows SID.
*
@@ -134,17 +141,47 @@ final class WindowsAccountUtils {
static boolean isWindowsSpecialSid(String sid) {
String tempSID = stripWindowsBackupPostfix(sid);
- if (SPECIAL_SIDS.contains(tempSID)) {
+ if (SPECIAL_SIDS_MAP.containsKey(tempSID)) {
return true;
}
- for (String specialPrefix: SPECIAL_SID_PREFIXES) {
+ for (String specialPrefix: SPECIAL_SID_PREFIXES_MAP.keySet()) {
if (tempSID.startsWith(specialPrefix)) {
return true;
}
}
+
+ // All the prefixes in the range S-1-5-80 to S-1-5-111 are special
+ tempSID = tempSID.replaceFirst(DOMAIN_SID_PREFIX + "-", "");
+ String subAuthStr = tempSID.substring(0, tempSID.indexOf('-'));
+ Integer subAuth = Optional.ofNullable(subAuthStr).map(Integer::valueOf).orElse(0);
+ if (subAuth >= 80 && subAuth <= 111) {
+ return true;
+ }
+
+
return false;
}
+ /**
+ * Get the name for the given special Windows SID.
+ *
+ * @param sid SID to check.
+ *
+ * @return Name for Windows special SID, an empty string if the SID is not a known special SID.
+ */
+ static String getWindowsSpecialSidName(String sid) {
+ String tempSID = stripWindowsBackupPostfix(sid);
+
+ if (SPECIAL_SIDS_MAP.containsKey(tempSID)) {
+ return SPECIAL_SIDS_MAP.get(tempSID);
+ }
+ for (Entry<String, String> specialPrefixEntry: SPECIAL_SID_PREFIXES_MAP.entrySet()) {
+ if (tempSID.startsWith(specialPrefixEntry.getKey())) {
+ return specialPrefixEntry.getValue();
+ }
+ }
+ return "";
+ }
/**
* Checks if the given SID is a user SID.
diff --git a/bindings/java/test/org/sleuthkit/datamodel/OsAccountTest.java b/bindings/java/test/org/sleuthkit/datamodel/OsAccountTest.java
index f3f9f2952b1661619ce3e8b8c78a6bbbae69130f..dd5085b89f8531d336b8b6bf32961ae708a8a342 100644
--- a/bindings/java/test/org/sleuthkit/datamodel/OsAccountTest.java
+++ b/bindings/java/test/org/sleuthkit/datamodel/OsAccountTest.java
@@ -742,7 +742,13 @@ public void windowsSpecialAccountTests() throws TskCoreException, OsAccountManag
String specialSid3 = "S-1-5-90-0-2";
String specialSid4 = "S-1-5-96-0-3";
-
+ // All accounts in the range S-1-5-80 to S-1-5-111 are special and should be created with SPECIAL_WINDOWS_REALM_ADDR
+ String specialSid5 = "S-1-5-99-0-3";
+ String specialSid6 = "S-1-5-100-0-3";
+ String specialSid7 = "S-1-5-111-0-3";
+ String specialSid8 = "S-1-5-112-0-3"; // NOT SPECIAL SID
+ String specialSid9 = "S-1-5-79-0-3"; // NOT SPECIAL SID
+
OsAccount specialAccount1 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid1, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
OsAccount specialAccount2 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid2, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
OsAccount specialAccount3 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid3, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
@@ -755,7 +761,18 @@ public void windowsSpecialAccountTests() throws TskCoreException, OsAccountManag
assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount4.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), true);
- }
+ OsAccount specialAccount5 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid5, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
+ OsAccount specialAccount6 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid6, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
+ OsAccount specialAccount7 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid7, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
+ OsAccount specialAccount8 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid8, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
+ OsAccount specialAccount9 = caseDB.getOsAccountManager().newWindowsOsAccount(specialSid9, null, null, host4, OsAccountRealm.RealmScope.UNKNOWN);
+
+ assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount5.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), true);
+ assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount6.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), true);
+ assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount7.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), true);
+ assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount8.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), false); // specialSid8 is NOT special.
+ assertEquals(caseDB.getOsAccountRealmManager().getRealmByRealmId(specialAccount9.getRealmId()).getRealmAddr().orElse("").equalsIgnoreCase(SPECIAL_WINDOWS_REALM_ADDR), false); // specialSid9 is NOT special.
+ }
// TEST: create accounts with a invalid user SIDs - these should generate an exception
{