False positives due to missing SMB connectivity

[ruppde]

Pingcastle produces many false positives if it can reach a DC via LDAP or ADWS but not SMB to download the GPOs. This is not visible in the report, the only indication is a single warning line during the pingcastle run. This happens quite regular in our environment as some foreign DCs have only firewall rules that allow LDAPS.

To reproduce:

1. Run pingcastle on a DC
2. Block port 445 with host firewall
3. Rerun pingcastle

In my sample these 5 additional rules matched:
A-AuditDC
A-AuditPowershell
A-HardenedPaths
P-UnkownDelegation
S-OldNtlm

Warning message in command line output:

...
[17:25:26] Gathering gpo data
Exception while generating GPO Data: The network path was not found.
...

Proposals:

1. If no SMB connection can be initiated, ignore all rules which need GPOs and clearly show the shortcoming in the report.
2. Improve the line Exception while generating GPO Data: The network path was not found. to Exception while generating GPO Data: The network path was not found. Please ensure connectivity to port TCP 445 to the domain controller.

trace.log with open 445 for S-OldNtlm:

...
Rule: PingCastle.Healthcheck.Rules.HeatlcheckRuleStaledOldNtlm
Step 1: GPO matches
Step 1: DisableNTLMV1
Step 1: Default Domain Controllers Policy
Step 1: dump
Step 1: GPO DisableNTLMV1
Step 1:       applied to : OU=XYZ Clients,DC=XYZ,DC=local
Step 1: GPO Default Domain Controllers Policy
Step 1:       applied to : OU=Domain Controllers,DC=XYZ,DC=local
Step 2: projection
Step 2: OU OU=XYZ Clients,DC=XYZ,DC=local
Step 2:       Order : 1 GPO: DisableNTLMV1
Step 2: OU OU=Domain Controllers,DC=XYZ,DC=local
Step 2:       Order : 3 GPO: Default Domain Controllers Policy
Step 3: projection
Step 3: OU=XYZ Clients,DC=XYZ,DC=local gpo DisableNTLMV1
Step 3: OU=Domain Controllers,DC=XYZ,DC=local gpo Default Domain Controllers Policy
...

trace.log with blocked 445 for S-OldNtlm:

...
Rule: PingCastle.Healthcheck.Rules.HeatlcheckRuleStaledOldNtlm
Step 1: GPO matches
Step 1: dump
Step 2: projection
Step 3: projection
  matched
...