Active Directory (AD) is a directory service created by Microsoft for Windows domain networks it provides an central location for network administration and security

learn more… | top users | synonyms

51
votes
1answer
3k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
15
votes
8answers
3k views

Monitoring Active Directory Domain Administrator Activities

I need to monitor Active Directory domain administrator activities and look for the following: Looking for anomalies in daily activity Getting alerted upon a violation My problem is that turning ...
13
votes
3answers
57k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
10
votes
3answers
947 views

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? When do I need a RADIUS server?
8
votes
3answers
7k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
8
votes
1answer
276 views

What practical uses are there for the AD feature of “Confidential Attributes”

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes? Would you store sensitive information here such as a private key, or a salt here? I'm ...
7
votes
1answer
2k views

Deploying a campus WiFi network that authenticates against an AD LDAP

We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
7
votes
2answers
866 views

Extracting Individual Records from NTDS.DIT

I am working with an extremely large NTDS.DIT file. It is about 20gb. Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart ...
7
votes
1answer
821 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
7
votes
1answer
3k views

What is the real risk from trusted forests / domains?

I am trying to identify specific attack vectors that occur due to domain/forest trust in Active Directory. Microsoft in their KB Articles Domain Trust, section "Considerations About Trusts" write that:...
7
votes
4answers
8k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = WScript.CreateObject("...
6
votes
3answers
8k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
6
votes
2answers
614 views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
6
votes
1answer
2k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
5
votes
3answers
2k views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
5
votes
3answers
14k views

To DMZ, or not to DMZ

So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network. The 'networks' are: Internal network DMZ The internet And the servers we ...
5
votes
4answers
339 views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
5
votes
2answers
3k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
3answers
461 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
5
votes
1answer
3k views

How does a client authenticate the domain controller

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller? PS: I'm having a problem getting info on how ...
5
votes
1answer
295 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql database....
5
votes
1answer
248 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
4
votes
3answers
3k views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
4
votes
1answer
252 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
4
votes
2answers
17k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
4
votes
1answer
129 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
4
votes
2answers
5k views

Storing the MAC Address of a computer in Active Directory

I’m considering enabling WoL (Wake on LAN) on the workstations on my network. In order to boot a workstation using WoL I require its MAC address. I could store the MAC address in a database, however ...
3
votes
5answers
8k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username &...
3
votes
2answers
3k views

LDAP Security problems?

I have installed many Active Directory (AD) based networks and have applied various standard security templates based on best practices, however I have never really looked at LDAP on a deeper level ...
3
votes
1answer
277 views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
3
votes
2answers
607 views

Does Windows keep an Active Directory user token while locked?

The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about ...
3
votes
1answer
5k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and IAS/...
3
votes
1answer
2k views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
3
votes
1answer
3k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
3
votes
2answers
41 views

Efficient way to demonstrate the value in Active Directory security improvements?

Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow ...
3
votes
1answer
207 views

Join a computer to the domain or not?

If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining ...
3
votes
1answer
61 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components (su4user,...
3
votes
1answer
102 views

Access control on a primarily windows LAN [closed]

This question is a bit broad, but I'm hoping someone can point me in the right direction. I administer a small LAN at work with 15-20 machines on it. They are running Windows XP - Windows 8 and I have ...
2
votes
2answers
4k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
2
votes
3answers
4k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
2
votes
2answers
564 views

Authentication for external applications

I need to design an application for internal corporate use. The application must be hosted externally. Ideally I'd like that application to be able to authenticate and authorize against the corporate ...
2
votes
3answers
3k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
2answers
7k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...
2
votes
2answers
4k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
2
votes
2answers
1k views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages (opposed to using a service user and ...
2
votes
2answers
313 views

Can I force unique passwords for domain admin accounts?

Best practices would dictate that domain admins should not be logged into as such for daily tasks. Ideally the user would have two accounts; Their "daily" account and their domain admin account. How ...
2
votes
1answer
615 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
2
votes
2answers
119 views

How to locate a domain controller on a Windows network when not a member?

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind. I've ...