@@ -7,6 +7,12 @@ namespace DSInternals.Common.Test;
77[ TestClass ]
88public class LapsTester
99{
10+ // The Windows SID key cache API overwrites the entire L0 key file on each write.
11+ // All TFM test processes must serialize their write+decrypt sequences to avoid
12+ // a process overwriting another's cache entry between WriteToCache() and Decrypt().
13+ // Shared with DnsSigningKeyTester because both write to the same on-disk cache.
14+ private static readonly Mutex CacheMutex = new Mutex ( false , @"Local\DSInternals_SidKeyCache" ) ;
15+
1016 [ TestMethod ]
1117 public void LAPS_Parse_Encrypted1 ( )
1218 {
@@ -21,7 +27,16 @@ public void LAPS_Parse_Encrypted1()
2127 var rootKeyResolver = new StaticKdsRootKeyResolver ( rootKey ) ;
2228
2329 // Try to decrypt the password
24- var lapsInfo = new LapsPasswordInformation ( "PC01" , encryptedLaps , LapsPasswordSource . EncryptedPassword , null , rootKeyResolver ) ;
30+ CacheMutex . WaitOne ( ) ;
31+ LapsPasswordInformation lapsInfo ;
32+ try
33+ {
34+ lapsInfo = new LapsPasswordInformation ( "PC01" , encryptedLaps , LapsPasswordSource . EncryptedPassword , null , rootKeyResolver ) ;
35+ }
36+ finally
37+ {
38+ CacheMutex . ReleaseMutex ( ) ;
39+ }
2540 Assert . AreEqual ( expectedPassword , lapsInfo . Password ) ;
2641 }
2742
@@ -39,9 +54,17 @@ public void LAPS_Parse_Encrypted2()
3954
4055 // Calculate the group keys and save them to cache
4156 var gke = GroupKeyEnvelope . Create ( rootKey , laps . EncryptedBlob . ProtectionKeyIdentifier , laps . EncryptedBlob . TargetSid ) ;
42- gke . WriteToCache ( ) ;
43-
44- var cleartextLaps = laps . Decrypt ( ) ;
57+ CacheMutex . WaitOne ( ) ;
58+ LapsClearTextPassword ? cleartextLaps ;
59+ try
60+ {
61+ gke . WriteToCache ( ) ;
62+ cleartextLaps = laps . Decrypt ( ) ;
63+ }
64+ finally
65+ {
66+ CacheMutex . ReleaseMutex ( ) ;
67+ }
4568 Assert . AreEqual ( expectedPassword , cleartextLaps . Password ) ;
4669 }
4770
0 commit comments