fix: exempt ESC4 template from setting template properties

Author: jakehildreth

ADCSGoat/Public/Deploy-AdcsGoat.ps1

@@ -9,21 +9,25 @@ function Deploy-AdcsGoat {
     )
 
     # We need blank template objects.
-    $TemplateNames | ForEach-Object { 
+    $TemplateNames | ForEach-Object {
         New-AdcsGoatBlankTemplateObject -TemplateName $_
     }
 
     # We need to assign properties to the blank template objects to turn them into real templates.
-    $TemplateNames | ForEach-Object {
-        $PropertiesPath = Join-Path -Path ".\Research" -ChildPath "${_}.xml" 
+    $TemplateNames.Where( { $_ -ne 'ESC4' } ) | ForEach-Object {
+        $PropertiesPath = Join-Path -Path ".\Research" -ChildPath "${_}.xml"
         $Properties = Import-Clixml -Path $PropertiesPath
         Set-AdcsGoatTemplateProperty -TemplateName $_ -Properties $Properties
     }
 
-    # We need to grant low privileged users control over blank template objects to turn them into ESC issues.
-    $TemplateNames | ForEach-Object {
+    # We need to grant low privileged users Enroll right on template objects to turn them into ESC issues.
+    $TemplateNames.Where( { $_ -ne 'ESC4' } ) | ForEach-Object {
         Set-AdcsGoatTemplateAce -TemplateName $_ -AceType Enroll
     }
+
+    # We need to grant low privileged users Full Control over a template object to turn it into an ESC4.
+    $TemplateNames.Where( { $_ -eq 'ESC4' } ) | ForEach-Object {
+        Set-AdcsGoatTemplateAce -TemplateName $_ -AceType GenericAll
+    }
 }
 
-