From 81827638acd229224616a2d083f67d233e86a301 Mon Sep 17 00:00:00 2001
From: tobor <rosborne@osbornepro.com>
Date: Sat, 28 Oct 2023 17:32:21 -0600
Subject: [PATCH] Update Install-SysmonBTPSSecPack.ps1

---
 Sysmon/Install-SysmonBTPSSecPack.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Sysmon/Install-SysmonBTPSSecPack.ps1 b/Sysmon/Install-SysmonBTPSSecPack.ps1
index 3e6cb49..2dfdd90 100644
--- a/Sysmon/Install-SysmonBTPSSecPack.ps1
+++ b/Sysmon/Install-SysmonBTPSSecPack.ps1
@@ -135,7 +135,7 @@ BEGIN {
     $DomainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
     $PrimaryDC = $DomainObj.PdcRoleOwner.Name
     $Domain = $DomainObj.Forest.Name
-
+    $NetlogonLocalPath = (Get-CimInstance -Class Win32_Share -Filter "Type=0 and Name LIKE 'NETLOGON'").Path
     If ($PrimaryDC.ToLower() -eq "$env:COMPUTERNAME.$((Get-CimInstance -ClassName Win32_ComputerSystem).Domain)".ToLower()) {
 
         $OutFile = "$NetlogonLocalPath\Sysmon\sysmon-config.xml"