Skip to content

Add get policies command - #64

Open
chryzsh wants to merge 3 commits into
Mayyhem:mainfrom
chryzsh:get-all-policies
Open

Add get policies command#64
chryzsh wants to merge 3 commits into
Mayyhem:mainfrom
chryzsh:get-all-policies

Conversation

@chryzsh

@chryzsh chryzsh commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Description

Adds get policies, which retrieves and writes all machine policy assignments from a management point, including non-secret policies.

The policy retrieval path now waits for each download to complete, handles download, decryption, XML parsing, and decompression failures per policy, decodes non-secret policy bodies as UTF-8, and removes nested XML declarations from decompressed content.

The PXE media-GUID flow remains supported by get secrets only. It was removed from get policies because that command does not implement the PXE flow.

No new dependencies are required.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Testing

  • Test A: Ran .\SharpSCCM_merged.exe get policies -o out against the test SCCM environment using an existing client for authentication. The command completed successfully and retrieved policy assignments and wrote them correctly to the specified output direcory.

  • Test B: Ran the PXE authentication path using the media certificate, x64 unknown-machine GUID, and media GUID extracted from PXE media:

    [xml]$xml = Get-Content -Raw .\loot\variables.xml
    $cert  = $xml.SelectSingleNode('//var[@name="_SMSTSMediaPFX"]').InnerText
    $media = $xml.SelectSingleNode('//var[@name="_SMSMediaGuid"]').InnerText
    $id    = $xml.SelectSingleNode('//var[@name="_SMSTSx64UnknownMachineGUID"]').InnerText
    
    .\SharpSCCM_merged.exe get secrets -c $cert -i $id -m $media
    

The command resolved the local management point and site code, retrieved 47 policy assignments, downloaded and decrypted the secret policy, and returned the expected Network Access Account credentials.

  • Test C: Added an MSTest regression test for decompressed policy XML that contains an XML declaration. The test verifies that decompressed child XML is retained without introducing a nested XML declaration. I also tested get secret because some of the code overlaps with that and found no breaking changes.

Test Configuration:

  • SCCM Site Version (result of .\SharpSCCM.exe get class-instances SMS_Site -p Version): 5.00.9128.1000
  • SCCM Client Version (result of .\SharpSCCM.exe local class-instances SMS_Client): 5.00.9128.1007

Bonus Points:

Wiki documentation update is prepared separately:
chryzsh/SharpSCCM.wiki branch get-all-policies, commit 596a944.

A maintainer can apply it with:

  git clone https://github.com/Mayyhem/SharpSCCM.wiki.git
  cd SharpSCCM.wiki
  git remote add chryzsh https://github.com/chryzsh/SharpSCCM.wiki.git
  git fetch chryzsh get-all-policies
  git cherry-pick 596a944
  git push origin master

Disclaimer: This code was initially generated with the assistance of AI. It has been manually guided, reviewed, and validated by me to ensure correctness, security, and alignment with project standards.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant