feat(gateway): WinRM operations for PAM dependency detection and rotation (PAM-350) - #321
Merged
x032205 merged 7 commits intoJul 27, 2026
Conversation
…ion (PAM-350) Add enumerate-accounts, enumerate-dependencies, rotate-credential, and sync-dependency WinRM operations so the control plane names a vetted operation and passes parameters instead of sending raw PowerShell. Credential changes use pure-PowerShell cmdlets (CIM Win32_Service.Change, Set-ScheduledTask, Set-ADAccountPassword) so a password never crosses a native-exe argument line.
|
💬 Discussion in Slack: #pr-review-cli-321-feat-gateway-winrm-operations-for-pam-dependency-detection-and Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
- Change service credentials via CIM Win32_Service.Change and scheduled tasks via Set-ScheduledTask (pure PowerShell) so a password with quotes isn't mangled by native-exe argument quoting. - Only restart a service/app-pool that was already running. - Include InteractiveOrPassword scheduled tasks; fail the enumeration hard on a service/task error so partial results can't prune real dependency rows.
- Add a validate-credential op so the admin rotator can verify a local account's password on the box (ValidateCredentials) without logging in as the account. - Only restart services/app-pools that were already running (done earlier), and now: harden local-account enumeration with ErrorActionPreference=Stop, include InteractiveOrPassword scheduled tasks, and gate IIS enumeration on the module being present so a real IIS error hard-fails instead of being swallowed.
- winrm/pam.go: resolve a scheduled task's run-as principal through the host's LSA (SID round-trip) so a member server's local account is not mis-anchored to a same-named domain account - winrm/winrm.go: decode PowerShell CLIXML stderr to plain text so a WinRM command failure surfaces the real error instead of the raw XML envelope
bernie-g
marked this pull request as ready for review
July 22, 2026 20:37
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
Contributor
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 2 · PR risk: 0/10 |
Contributor
|
| Filename | Overview |
|---|---|
| packages/gateway-v2/winrm/pam.go | Adds privileged discovery and credential operations; IIS synchronization can select the wrong pool or leave a partial credential update. |
| packages/gateway-v2/winrm/winrm.go | Adds CLIXML error cleanup using standard-library regular expressions and numeric parsing. |
| packages/gateway-v2/winrm_handler.go | Registers and implements five new WinRM request handlers. |
Reviews (1): Last reviewed commit: "gateway: qualify scheduled-task principa..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
- winrm/pam.go: Set-ItemProperty -LiteralPath so an app-pool name containing PowerShell wildcard chars is matched literally, not expanded as a pattern - write only the pool password (the run-as identity is unchanged during a rotation), removing the separate userName write and its partial-commit hazard
x032205
requested changes
Jul 23, 2026
x032205
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion PR (backend + frontend): Infisical/infisical#7355
Adds the gateway's WinRM operations for finding Windows account dependencies and updating their passwords during rotation.