Skip to content

Commit 0e92659

Browse files
committed
Made changes as per copilot's suggestions
1 parent 4615c6d commit 0e92659

2 files changed

Lines changed: 10 additions & 6 deletions

File tree

src/powershell/public/Invoke-ZtAssessment.ps1

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,10 @@ $titleLine
249249
#region Preparation
250250
Show-ZtiBanner
251251

252+
# Always reset emergency access accounts at the start of each run to prevent stale
253+
# config from a previous Invoke-ZtAssessment call carrying over (Issue #266 follow-up).
254+
Set-PSFConfig -FullName 'ZeroTrustAssessment.EmergencyAccessAccounts' -Value $null
255+
252256
$effectiveIgnore = $IgnoreLanguageMode -or $script:IgnoreLanguageMode
253257
if (-not (Test-ZtLanguageMode -IgnoreLanguageMode:$effectiveIgnore)) {
254258
Stop-PSFFunction -Message "PowerShell is running in Constrained Language Mode, which is not supported." -EnableException $true -Cmdlet $PSCmdlet
@@ -314,10 +318,7 @@ $titleLine
314318
Write-Host "🔐 " -NoNewline -ForegroundColor Cyan
315319
Write-Host "Loaded $($emergencyAccounts.Count) emergency access account(s) from configuration." -ForegroundColor White
316320
}
317-
else {
318-
# Clear any previously loaded emergency accounts to prevent stale config in multi-run sessions
319-
Set-PSFConfig -FullName 'ZeroTrustAssessment.EmergencyAccessAccounts' -Value $null
320-
}
321+
# Note: stale-clear is now performed unconditionally at the start of Invoke-ZtAssessment.
321322

322323
Write-Host "" -NoNewline -ForegroundColor Green
323324
Write-Host "Configuration loaded successfully. Command line parameters will override configuration file values." -ForegroundColor White

src/powershell/tests/Test-Assessment.21815.ps1

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,15 @@ from vwRole
4949
$results = @($permanentPrivileged | Where-Object { $emergencyAccountIds -notcontains $_.principalId })
5050
$excludedEmergencyAccounts = @($permanentPrivileged | Where-Object { $emergencyAccountIds -contains $_.principalId })
5151

52+
# Count of *distinct* excluded emergency accounts (one user can have multiple permanent role assignments)
53+
$excludedAccountCount = @($excludedEmergencyAccounts | Select-Object -ExpandProperty principalId -Unique).Count
54+
5255
$testResultMarkdown = ""
5356

5457
if ($results.Count -eq 0) {
5558
$passed = $true
56-
if ($excludedEmergencyAccounts.Count -gt 0) {
57-
$testResultMarkdown += "No privileged users have permanent role assignments (excluding $($excludedEmergencyAccounts.Count) emergency access account(s) which are expected to have permanent assignments)."
59+
if ($excludedAccountCount -gt 0) {
60+
$testResultMarkdown += "No privileged users have permanent role assignments (excluding $excludedAccountCount emergency access account(s) which are expected to have permanent assignments)."
5861
}
5962
else {
6063
$testResultMarkdown += "No privileged users have permanent role assignments."

0 commit comments

Comments
 (0)