Active Directory (AD) is a directory service created by Microsoft for Windows domain networks it provides an central location for network administration and security

learn more… | top users | synonyms

1
vote
1answer
4k views

What are the risks of removing ISATAP from the default global block list?

The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command: dnscmd /config ...
1
vote
2answers
130 views

Can I force unique passwords for domain admin accounts?

Best practices would dictate that domain admins should not be logged into as such for daily tasks. Ideally the user would have two accounts; Their "daily" account and their domain admin account. How ...
1
vote
1answer
552 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
1
vote
1answer
87 views

What happens if someone steals one of my additional domain controllers

What happens if someone steals one of my additional domain controllers? What information could an attacker get from my domain controller?
1
vote
1answer
65 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
1
vote
1answer
95 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
1
vote
1answer
175 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
1answer
194 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
1answer
99 views

Is Domain Logins a potential attack vector?

Say you have a windows server that works as a PDC AD box. Is this a potential Attack Vector for a small 20 people buisness? Wouldn't it be better to simply have an encrypted database file with all the ...
1
vote
1answer
443 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
1
vote
1answer
991 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
1
vote
2answers
166 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
1
vote
1answer
766 views

Client access to domain controller

I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity. AD Query ...
1
vote
0answers
63 views

Password-less authentication using corporate Active Directory on external (internet) site [migrated]

I need to restrict access to an external site so that: users who are in the corporate network have full access to the site's functionality, those who are not - only limited functionality. In the ...
1
vote
0answers
32 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
1
vote
0answers
59 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
1
vote
0answers
52 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
1
vote
1answer
961 views

Brute Forcing Domain Controller

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
1
vote
1answer
682 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
1
vote
0answers
230 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
1
vote
0answers
244 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
1
vote
2answers
732 views

Strange Event Log Entry - Windows Server 2008

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC. An account failed to log on. Subject: Security ID: NULL SID Account Name: ...
0
votes
2answers
215 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
0
votes
1answer
45 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
0
votes
1answer
198 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
0
votes
2answers
177 views

Trust relationship between domains

I am working in a organisation where it has a structure of parent company and Subsidiary. Both are individual domains without Trust. I work for Subsidiary Requirement is Subsidiary company should ...
0
votes
1answer
255 views

How do you secure service account password on enterprise windows enviroment?

I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain. Some domain accounts are used for application\middleware authentication that needs high ...
0
votes
1answer
149 views

opening up Active directory to cloud services?

We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the ...
0
votes
1answer
610 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
0
votes
1answer
942 views

How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?

Short version What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD Background I'm working with a company that has various business agreements between many ...
0
votes
0answers
6 views

Is it possible to allow anonymous users to access part of an Azure website which uses Active Directory

I have a website hosted in Azure that uses Active Directory to prevent anyone from accessing it except for a few test users. Now I would like to expose a single page so that anyone can access it. I've ...
0
votes
0answers
35 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
0answers
112 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
0answers
59 views

Federation Service to Azure with users from trusted domain.

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? As a internal team member, I must be able to login to the site with Windows ...
0
votes
0answers
238 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
0
votes
0answers
20 views

Active Directory - Denial-of-Service [duplicate]

How can I prevent a user on the domain from launching a denial-of-service attack against Active Directory by scripting bad password attempts against every user in the domain?
-1
votes
1answer
733 views

Routable Domain for DC?

What is the impact of having a routable domain name in windows network infrastucture ? Having example.com in place of exemple.local as domain name have an critical impact ? if yes what should I keep ...
-1
votes
0answers
38 views

How to audit an Active Directory only knowing its IP address? [on hold]

Is it possible to audit an Active Directory only knowing its IP address? In my job, they provide me with the Active Directory IP addresses and ask me to check whether the passwords issued by the ...