Active Directory (AD) is a directory service created by Microsoft for Windows domain networks it provides an central location for network administration and security

learn more… | top users | synonyms

2
votes
2answers
67 views

How to locate a domain controller on a Windows network when not a member?

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind. I've ...
0
votes
0answers
7 views

How do I trade an OAuth token for a Fedauth token with Azure AD? [migrated]

I am trying to access a resource that's secured with Azure Active Directory. I can see from the HTTP traffic that my browser uses a Fedauth token when accessing the resource, but I need to access this ...
3
votes
1answer
1k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
0
votes
1answer
42 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
1
vote
1answer
23 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
1
vote
1answer
74 views

What happens if someone steals one of my additional domain controllers

What happens if someone steals one of my additional domain controllers? What information could an attacker get from my domain controller?
2
votes
2answers
57 views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
0
votes
0answers
32 views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages. It especially means the directory ...
1
vote
1answer
56 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
0answers
50 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
3
votes
2answers
86 views

Corporate Domain-Joined PC Used in China [closed]

What would be the disadvantages of allowing a user to travel to China (business trip) using a domain-joined corporate Windows PC as opposed to a non-domain-joined PC?
1
vote
0answers
53 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
2
votes
1answer
42 views

Is it possible to cause a DOS attack on a domain by spoofing the DC's NTP request?

According to this page: Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong ...
1
vote
2answers
79 views

Can I force unique passwords for domain admin accounts?

Best practices would dictate that domain admins should not be logged into as such for daily tasks. Ideally the user would have two accounts; Their "daily" account and their domain admin account. How ...
1
vote
2answers
2k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...
0
votes
0answers
36 views

Federation Service to Azure with users from trusted domain.

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? As a internal team member, I must be able to login to the site with Windows ...
0
votes
0answers
161 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
0
votes
2answers
136 views

Trust relationship between domains

I am working in a organisation where it has a structure of parent company and Subsidiary. Both are individual domains without Trust. I work for Subsidiary Requirement is Subsidiary company should ...
13
votes
3answers
30k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
3
votes
1answer
240 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
1
vote
1answer
130 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
1
vote
1answer
146 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
0
votes
0answers
20 views

Active Directory - Denial-of-Service [duplicate]

How can I prevent a user on the domain from launching a denial-of-service attack against Active Directory by scripting bad password attempts against every user in the domain?
0
votes
2answers
118 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
2
votes
1answer
92 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
1
vote
2answers
2k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
2
votes
1answer
41 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components ...
4
votes
3answers
3k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
1
vote
1answer
91 views

Is Domain Logins a potential attack vector?

Say you have a windows server that works as a PDC AD box. Is this a potential Attack Vector for a small 20 people buisness? Wouldn't it be better to simply have an encrypted database file with all the ...
0
votes
0answers
80 views

MS Certificate Services, SCEP and Domain Credentials

I'm reading about Simple Certificate Enrollment Protocol (SCEP)2 vulnerabilities from CSS's The Use of the Simple Certificate Enrollment Protocol (SCEP) and Untrusted Devices. The paper discusses a ...
2
votes
1answer
76 views

Access control on a primarily windows LAN [closed]

This question is a bit broad, but I'm hoping someone can point me in the right direction. I administer a small LAN at work with 15-20 machines on it. They are running Windows XP - Windows 8 and I have ...
0
votes
1answer
190 views

How do you secure service account password on enterprise windows enviroment?

I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain. Some domain accounts are used for application\middleware authentication that needs high ...
1
vote
0answers
47 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
2
votes
1answer
3k views

Where does Active Directory store user hashes?

During a penetration test for a client, having an infrastructure with multiple (5) Active Directory Servers (Win Serv 2008 R2)... I found a nice exploit to drop a system shell in one of the servers, ...
4
votes
3answers
562 views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
2
votes
2answers
2k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
5
votes
3answers
1k views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
2
votes
2answers
297 views

Barracuda antispam access to active directory in dmz : opening port or not?

I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed. What I see on the web is people ...
2
votes
2answers
247 views

Authentication for external applications

I need to design an application for internal corporate use. The application must be hosted externally. Ideally I'd like that application to be able to authenticate and authorize against the corporate ...
6
votes
0answers
218 views

Use token for Windows Server 2008 AD RMS

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
1
vote
1answer
388 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
4
votes
2answers
2k views

Storing the MAC Address of a computer in Active Directory

I’m considering enabling WoL (Wake on LAN) on the workstations on my network. In order to boot a workstation using WoL I require its MAC address. I could store the MAC address in a database, however ...
3
votes
2answers
1k views

LDAP Security problems?

I have installed many Active Directory (AD) based networks and have applied various standard security templates based on best practices, however I have never really looked at LDAP on a deeper level ...
2
votes
1answer
261 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
4
votes
3answers
7k views

To DMZ, or not to DMZ

So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network. The 'networks' are: Internal network DMZ The internet And the servers we ...
-1
votes
1answer
590 views

Routable Domain for DC?

What is the impact of having a routable domain name in windows network infrastucture ? Having example.com in place of exemple.local as domain name have an critical impact ? if yes what should I keep ...
2
votes
2answers
474 views

Implications of using domain\computername$ account to serve SQL data to IIS

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5). The application connects to a SQL Server database back-end ...
3
votes
2answers
384 views

Does Windows keep an Active Directory user token while locked?

The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about ...
3
votes
4answers
5k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username ...
1
vote
2answers
700 views

Strange Event Log Entry - Windows Server 2008

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC. An account failed to log on. Subject: Security ID: NULL SID Account Name: ...