Active Directory (AD) is a directory service created by Microsoft for Windows domain networks it provides an central location for network administration and security

learn more… | top users | synonyms

2
votes
3answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
0
votes
1answer
68 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
0
votes
0answers
12 views

Using a Service Principle as a user account

An answer on this question made me curious about the security implications of using a service principle as a user account under (Azure) Active Directory Fundamentally it strikes me that its just a ...
0
votes
0answers
25 views

Is it a bad idea to have a public facing server being logged in in my Windows Server 2012 Essentials VPN?

I've got a home network setup with a Windows Server 2012 R2 Essentials which is accessible via the *.remotewebaccess.com service. I'm also having a Windows virtual server that's obviously publicly ...
0
votes
0answers
144 views

What is Badlock and how does it work?

A while back there was an announcement for the disclosure of a security vulnerability named "Badlock" - including this fancy name and a logo. The disclosure date was today and I was surprised (and ...
3
votes
1answer
265 views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
7
votes
4answers
8k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = WScript.CreateObject("...
4
votes
1answer
99 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
3
votes
2answers
40 views

Efficient way to demonstrate the value in Active Directory security improvements?

Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow ...
15
votes
8answers
2k views

Monitoring Active Directory Domain Administrator Activities

I need to monitor Active Directory domain administrator activities and look for the following: Looking for anomalies in daily activity Getting alerted upon a violation My problem is that turning ...
0
votes
1answer
70 views

How does resetting passwords twice increase security after a breach?

In regards to https://mva.microsoft.com/en-US/training-courses/how-to-avoid-golden-ticket-attacks-12134 They mention several times that resetting not only AD passwords twice but also local computer ...
3
votes
1answer
174 views

Join a computer to the domain or not?

If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining ...
0
votes
1answer
33 views

Active Directory password complexity based onto entropy

I am evaluating the possibility to enable password complexity rules into my Active Directory, but the rules it offers are for me not good. So I would like to have a complexity rule based onto only two ...
1
vote
1answer
31 views

What are the real risks of enabling unsecure DNS updates on Active Directory intranet domain?

Based on my current research, enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN. While this works fine for Windows machines ...
0
votes
2answers
343 views

Trust relationship between domains

I am working in a organisation where it has a structure of a parent company and a subsidiary. Both are individual domains without trust. I work for the subsidiary The requirement is that the ...
0
votes
2answers
102 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
2
votes
0answers
71 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
7
votes
2answers
654 views

Extracting Individual Records from NTDS.DIT

I am working with an extremely large NTDS.DIT file. It is about 20gb. Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart ...
0
votes
1answer
2k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
0
votes
0answers
92 views

How to do secure file transfer on windows with AD?

I have a requirement to serve files from a windows 2008 (and up) server that will be part of an AD domain to client machines that will also be members of that same domain. The requirements are as ...
6
votes
2answers
711 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
0
votes
0answers
120 views

Is it possible to allow anonymous users to access part of an Azure website which uses Active Directory

I have a website hosted in Azure that uses Active Directory to prevent anyone from accessing it except for a few test users. Now I would like to expose a single page so that anyone can access it. I've ...
1
vote
0answers
94 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
3
votes
5answers
8k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username &...
5
votes
3answers
456 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
0
votes
0answers
229 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
1answer
163 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
5
votes
4answers
304 views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
8
votes
3answers
7k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
5
votes
1answer
247 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
4
votes
1answer
242 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
2
votes
2answers
4k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
4
votes
2answers
17k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
2answers
1k views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages (opposed to using a service user and ...
2
votes
2answers
115 views

How to locate a domain controller on a Windows network when not a member?

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind. I've ...
3
votes
1answer
3k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
0
votes
1answer
752 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
1
vote
1answer
93 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
1
vote
1answer
96 views

What happens if someone steals one of my additional domain controllers

What happens if someone steals one of my additional domain controllers? What information could an attacker get from my domain controller?
0
votes
1answer
178 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
0answers
231 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
2
votes
2answers
101 views

Corporate Domain-Joined PC Used in China [closed]

What would be the disadvantages of allowing a user to travel to China (business trip) using a domain-joined corporate Windows PC as opposed to a non-domain-joined PC?
1
vote
0answers
61 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
2
votes
1answer
244 views

Is it possible to cause a DOS attack on a domain by spoofing the DC's NTP request?

According to this page: Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong ...
2
votes
2answers
301 views

Can I force unique passwords for domain admin accounts?

Best practices would dictate that domain admins should not be logged into as such for daily tasks. Ideally the user would have two accounts; Their "daily" account and their domain admin account. How ...
2
votes
2answers
7k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...
0
votes
0answers
422 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
13
votes
3answers
55k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
3
votes
1answer
2k views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
0
votes
1answer
293 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?