Active Directory (AD) is a directory service created by Microsoft for Windows domain networks it provides an central location for network administration and security
-1
votes
0answers
32 views
Routable Domain for DC?
What is the impact of having a routable domain name in windows network infrastucture ?
Having example.com in place of exemple.local as domain name have an critical impact ? if yes what should I keep ...
-1
votes
0answers
26 views
Local System Restricted via GPO in Microsoft OS [migrated]
If there is a way, to deny local-system on a client machine to stop services with GPO?.
The client is in a domain.
Example, making a anti-virus service that can't be disabled by local-system.
I ...
2
votes
2answers
72 views
Implications of using domain\computername$ account to serve SQL data to IIS
One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5).
The application connects to a SQL Server database back-end ...
2
votes
1answer
80 views
Barracuda antispam access to active directory in dmz : opening port or not?
I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed.
What I see on the web is people ...
2
votes
2answers
140 views
Prevent unauthorized workstations from joining a Windows Domain
Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
0
votes
1answer
73 views
opening up Active directory to cloud services?
We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the ...
1
vote
1answer
169 views
Brute Forcing Domain Controller
I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
0
votes
3answers
447 views
To DMZ, or not to DMZ
So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network.
The 'networks' are:
Internal network
DMZ
The internet
And the servers we ...
1
vote
1answer
215 views
iOS auth/auth with a REST Webservice
we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
6
votes
2answers
108 views
Implications of having a service account in AD use RC4 rather than AES for Kerberos?
Bear with me, I know this is sloppy, but here is the back story:
We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
1
vote
1answer
140 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
3
votes
1answer
709 views
what is the role of RADiUS server and Active Directory to increase the security in wireless networks?
In the CBT Nuggets Video Training, one slide about Wireless networks :
i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
2
votes
3answers
228 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
2answers
88 views
Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?
Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination.
If we disable the account prior to wiping the device (or the device receiving the wipe ...
4
votes
1answer
502 views
How does a client authenticate the domain controller
On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller?
PS: I'm having a problem getting info on how ...
7
votes
3answers
1k views
How to manage admin rights for helpdesk staff?
My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting.
Helpdesk staff commonly require administrative rights to provide support for end users. I ...
0
votes
0answers
97 views
A plan that will allow all the Supervisory conductors (SC's) access to the networked transport control module [closed]
Propose a plan that will allow all the SC's access to the networked transport control module and other resources in the HQ domain while preventing them from accessing other resources in all the other ...
1
vote
0answers
114 views
AD authentication with high amount of ICMP traffic [closed]
We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
6
votes
1answer
534 views
What is the real risk from trusted forests / domains?
I am trying to identify specific attack vectors that occur due to domain/forest trust in Active Directory. Microsoft in their KB Articles Domain Trust, section "Considerations About Trusts" write ...
0
votes
1answer
534 views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
0
votes
1answer
246 views
How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?
This document describes how there are 3 ways to constrain a SmartCard certificate
The Enhanced Key Usage field defines one or more purposes for which
the public key may be used. RFC 5280 states ...
2
votes
4answers
2k views
Two-factor authentication w/certificate and username & password?
Example scenario:
ActiveSync
Authentication method:
certificate-based authentication AND Active Directory domain username-password
Encrypted on device:
public & private key
AD username ...
24
votes
1answer
969 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
1
vote
1answer
931 views
What are the risks of removing ISATAP from the default global block list?
The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command:
dnscmd /config ...
1
vote
1answer
262 views
Multiple security layers for SOA REST intranet services
For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
2
votes
2answers
3k views
How to use OAuth with Active Directory
I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
1
vote
1answer
206 views
If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password
Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...
2
votes
1answer
243 views
Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called example.com. This company has a variety of internal and ...
4
votes
2answers
306 views
How does multi factor authentication modify the AD authentication process?
I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication.
Possible things that might have to be modified:
Active Directory / Domain ...
1
vote
0answers
152 views
What is the best way to manage temporary accounts on Active Directory [closed]
The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
1
vote
1answer
474 views
Client access to domain controller
I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity.
AD Query ...
2
votes
1answer
292 views
What information is exposed in AD's Service Connection Points (SCP)
Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have ...
1
vote
2answers
462 views
Strange Event Log Entry - Windows Server 2008
Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: ...
0
votes
1answer
393 views
How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?
Short version
What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD
Background
I'm working with a company that has various business agreements between many ...
8
votes
1answer
153 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
3
votes
1answer
530 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
2
votes
2answers
474 views
LDAP Security problems?
I have installed many Active Directiory based networks and have applied various standard security templates based on best practices, however I have never really looked at LDAP on a deeper level and ...
5
votes
1answer
194 views
Using AD authentication in a publicly accessible webapp
I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql ...
6
votes
1answer
607 views
Deploying a campus WiFi network that authenticates against an AD LDAP
We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
10
votes
3answers
7k views
How do you discover what permissions an AD group has, if you have no documentation?
You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
5
votes
2answers
625 views
Password History/Password policy
I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008).
Where is password ...
5
votes
2answers
247 views
How can I detect users that have requested AD Administrators to reuse an expired password?
There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it.
...
