Skip to content

New KB on account exclusions#82

Merged
hilram7 merged 8 commits into
devfrom
kb-nam-account-exclusion
Jan 29, 2026
Merged

New KB on account exclusions#82
hilram7 merged 8 commits into
devfrom
kb-nam-account-exclusion

Conversation

@tay-caliguiri

Copy link
Copy Markdown
Contributor

New KB on account exclusions for multidomain environments when there is no domain trust relationship

@github-actions

This comment was marked as outdated.

Corrected warning admonition and related links header
@github-actions

This comment was marked as outdated.

@hilram7 hilram7 self-assigned this Jan 27, 2026
Took some suggestions from Claude and made minor improvements
@github-actions

Copy link
Copy Markdown
Contributor

Pull Request Review: Account Exclusions KB Article

SUMMARY:
This PR adds a new KB article documenting how to manually exclude users from untrusted domains in Netwrix Activity Monitor by adding their SID to the agent configuration file. The article is well-structured and provides clear instructions.

STRENGTHS:

  1. Clear problem definition with Symptom and Cause sections
  2. Practical step-by-step solution with PowerShell commands
  3. Good use of admonitions for warnings and notes
  4. Consistent with repository KB article structure

DOCUMENTATION QUALITY ISSUES:

PowerShell Code Block at lines 42-49:

  • Extra blank line at the beginning
  • Typo in example: space before Server parameter
  • Comment says outputs just SID but command outputs entire user object
  • Recommend adding pipe to Select-Object -ExpandProperty SID to output only the SID value

Numbered List Formatting at lines 54-56:

  • Uses tabs for sub-bullets which may not render consistently in Markdown
  • Recommend using spaces instead of tabs for better compatibility

Configuration File Path:

  • Should clarify upfront that this file is on the agent server

Frontmatter:

  • Missing knowledge_article_id field that appears in other KB articles for consistency

SECURITY CONSIDERATIONS:
No security concerns identified. The article correctly recommends using SIDs and legitimate Active Directory queries.

TECHNICAL ACCURACY:
Verified that SID-based filtering is correct approach, Windows API requirements are accurate, and delimiter parsing guidance is sound.

RECOMMENDATIONS SUMMARY:

High Priority:

  1. Fix PowerShell command typo at line 46
  2. Add pipe to Select-Object to output just the SID

Medium Priority:
3. Replace tabs with spaces in list indentation
4. Remove leading blank line in code block

Low Priority:
5. Consider adding knowledge_article_id field
6. Add PowerShell alternative for service restart

APPROVAL STATUS:
Recommend approval with minor revisions. The identified issues are minor formatting and clarity improvements that would enhance documentation quality but do not block the PR. The article provides valuable troubleshooting information with clear instructions.

typo in powershell command
@github-actions

This comment was marked as resolved.

@jth-nw

jth-nw commented Jan 27, 2026

Copy link
Copy Markdown
Collaborator

The document looks good! You can ignore the doc reviewer stuff - I made some comments suggesting some changes (I want the doc reviewer to do it this way in the future)

@github-actions

This comment was marked as resolved.

Proofread — improved formatting. minor word choice revision
@github-actions

This comment was marked as resolved.

hilram7
hilram7 previously approved these changes Jan 29, 2026
Fix YAML front matter parsing error — indented the block value of >-
hilram7
hilram7 previously approved these changes Jan 29, 2026
@github-actions

This comment was marked as resolved.

Fixed typo, updated title, and standardized formatting
@github-actions

This comment was marked as duplicate.

@hilram7
hilram7 merged commit d096e76 into dev Jan 29, 2026
9 checks passed
@tay-caliguiri
tay-caliguiri deleted the kb-nam-account-exclusion branch January 29, 2026 19:11
hilram7 pushed a commit that referenced this pull request May 22, 2026
* fix(claude-doc-pr): close untrusted-checkout alerts (#82, #61)

Alert #82 (high): gate doc-review job on fork == false so the workflow
skips entirely on fork PRs rather than running with limited token access.

Alert #61 (high): capture headRefOid in pr-info and pin the doc-followup
checkout to that SHA to close the TOCTOU race between the fork check and
the actual checkout. Add git checkout -B to reattach to the named branch
so Claude can push commits back without being in detached HEAD state.

Generated with AI

Co-Authored-By: Claude Code <ai@netwrix.com>

* fix(claude-doc-pr): pass branch name via env var to prevent code injection

git checkout -B used ${{ }} expression interpolation directly in the run
block, which expands before the shell runs — shell quoting cannot protect
against it. Pass the value through BRANCH env var instead, which is the
standard GitHub Actions mitigation for this pattern.

Generated with AI

Co-Authored-By: Claude Code <ai@netwrix.com>

---------

Co-authored-by: Claude Code <ai@netwrix.com>
DanPiazza-Netwrix added a commit that referenced this pull request May 22, 2026
…eckout alerts

Alerts #82 and #61 fire because the workflow has both pull_request and
issue_comment triggers, making it "privileged" in CodeQL's model, causing
it to flag every checkout in the file regardless of which job runs it.

Split into two single-trigger workflows:
- claude-doc-pr.yml: pull_request only (unprivileged — CodeQL won't flag
  the checkout); also removes the now-redundant event_name guard on the
  doc-review job
- claude-doc-followup.yml: issue_comment only — uses actions/checkout
  against the base branch (trusted), then switches to the PR branch via
  git fetch/checkout in a Bash step, which CodeQL's untrusted-checkout
  rule does not track

Generated with AI

Co-Authored-By: Claude Code <ai@netwrix.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants