src/CommonLib/OutputTypes/Computer.cs (1)

65-69: Document intent and consider initializing the new field

This holds the SDDL from HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters:VulnerableChannelAllowList (the allow-list backing the “Allow vulnerable Netlogon secure channel connections” policy). A short XML doc comment would prevent ambiguity, and initializing avoids null consumers. (calcomsoftware.com, support.microsoft.com)

Apply:

 public class DCRegistryData {
   public IntRegistryAPIResult CertificateMappingMethods { get; set; }
   public IntRegistryAPIResult StrongCertificateBindingEnforcement { get; set; }
-  public StrRegistryAPIResult VulnerableNetlogonSecurityDescriptor { get; set; }
+  /// <summary>
+  /// SDDL from HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\VulnerableChannelAllowList,
+  /// which controls exceptions for vulnerable Netlogon secure channel connections.
+  /// </summary>
+  public StrRegistryAPIResult VulnerableNetlogonSecurityDescriptor { get; set; } = new();
 }

src/CommonLib/OutputTypes/APIResults/StrRegistryAPIResult.cs (1)

1-7: Make Value non-null by default (aligns with typical APIResult consumers)

Calls may return “collected but not present”; returning empty avoids null-handling churn and matches how int results use a sentinel.

 namespace SharpHoundCommonLib.OutputTypes
 {
     public class StrRegistryAPIResult : APIResult
     {
-        public string Value { get; set; }
+        public string Value { get; set; } = string.Empty;
     }
 }

src/CommonLib/Processors/DCRegistryProcessor.cs (2)

106-114: Harden against unexpected registry data types

On some systems the value might be stored or returned differently; handle string[] defensively and surface an explicit FailureReason on type mismatch. (learn.microsoft.com)

-            if (data.Value == null)
-            {
-                return ret;
-            }
-
-            ret.Value = (string)data.Value;
+            if (data.Value == null)
+            {
+                return ret;
+            }
+            if (data.Value is string s)
+            {
+                ret.Value = s;
+                return ret;
+            }
+            if (data.Value is string[] arr)
+            {
+                ret.Value = string.Join(";", arr);
+                return ret;
+            }
+            ret.FailureReason = $"Unexpected registry value type for {subValue}: {data.Value.GetType().Name}";

---

95-97: Minor: add a short inline comment with the policy name for future readers

Reduces context-switching when scanning code later. (support.microsoft.com)

-            const string subValue = "VulnerableChannelAllowList";
+            const string subValue = "VulnerableChannelAllowList"; // GPO: "Domain controller: Allow vulnerable Netlogon secure channel connections"

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro