Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the domain with "unauthorized" machines? Suppose the user connects non-simultaneously and can rename their machine to match an "authorized" machine's name.

share|improve this question
    
This is a valid question and received a -1. I did a +1 to balance it out. –  makerofthings7 Apr 4 '13 at 3:32

2 Answers 2

up vote 2 down vote accepted

I assume you're concerned about Domain Users using the default privilege to add up to 10 workstations to the domain, without Domain Admin permission.

To control who has access to add users to the domain, edit this Local Security policy on the DC

Computer Configuration | Windows settings | Security Settings | User Rights Assignment | Add Workstations to the Domain

Next, if you want to see who added a workstation to the domain I would suggest looking at:

  • The AD Audit log on every Domain Controller

  • The AD Computer object itself using ADSI Edit (there may be a "created by" SID there)

Furthermore you asked:

Suppose the user connects non-simultaneously and can rename their machine to match an "authorized" machine's name.

There are two parts to this: the Kerberos impersonation and the NetBIOS impersonation. Depending on your GPO settings it may be possible for a person to rename and impersonate one or both authentication types for a given "unauthorized machine".

If the imposter can convince DNS, which is protected by an ACL, and it can edit AD (via SPNs or other administrative function), the it's possible to impersonate a Kerberos server. It's up to your application to detect this impersonation. An example of impersonation is Windows Terminal Server 2008 and newer. It will pop up a dialog box stating there is an insecure network connection.

On the other hand NTLM based authentication can have "imposters" and it's next to impossible for the client to detect this. The only defense you have is to disable NTLM and use Kerberos exclusively.

If you need to use NTLM for some hosts and not others, follow Eric G.'s suggestions

share|improve this answer
    
My concern was more the scenario when a user brings their laptop from home and connects to the corporate LAN, using their AD login. –  cyberSecurity Apr 4 '13 at 6:47

I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin privileges).

Theoretically, it's possible they could image their work machine and put it on their own hardware, but that would not allow them to change the system settings and gain more privileges, it would still generally be your GPO in affect. To counter this, a combination of TPM and encryption would help.

If you want to block unauthorized systems from joining the network, you would probably want to do this a layer domain from Active Directory at the network level. You could implement 802.1x port security or any other type of network access control (NAC).

More resources:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.