[Query Issue]: Users with logon scripts stored in a trusted domain #58

Activity

1. martinsohn

   added a commit that references this issue on Jun 9, 2026

   Address query bugs

   ...

   fb37b6f
2. martinsohn commented on Jun 9, 2026

   

   martinsohn

   on Jun 9, 2026

   Collaborator

   More actions

   Thank you for reporting! I am fixing this in an upcomig release.

   This query has been bugging me for a long time, so I will reduce it to simply Users with logon scripts.

   • The check for logon script WITHIN a trusted domain is equally important, if not less important, than a logon script OUTSIDE a trusted domain.

   • The query itself is complex and brittle

     This is my current best iteration:

     MATCH (n:User)
     WHERE n.logonscript IS NOT NULL
     MATCH (d:Domain)<-[:SameForestTrust|CrossForestTrust]-(:Domain)-[:Contains*1..]->(n)
     WHERE toUpper(n.logonscript) STARTS WITH ("\\\\" + toUpper(d.name) + "\\")
     RETURN n
     

     However, it can still return false-negagives due to possible variations of the network path: FQDN, short domain name, explicit server/DC hostnames, IP addresses, ...
3. martinsohn commented on Aug 5, 2026

   

   martinsohn

   on Aug 5, 2026

   Collaborator

   More actions

   Fixed in the latest release.
4. martinsohn

   closed this as completedon Aug 5, 2026