Hot answers tagged active-directory
28
If you have access, check the Security Event logs: eventvwr.msc .
Look for failed logon events and you will see your password as an unknown user account if the logging is set up to record those kinds of events.
EDIT
I just tested this on Win7 SP1. It requires that Failure Auditing is enabled. I tried to log in with a bogus username, and this was the ...
10
Let me preface what will probably be a longish answer with "There is no simple solution".
Solving this will take some strategic work (which is why I recommended not moving this to SF).
Now I will explain why.
Windows, at its core, is mostly based on the DAC model of access control.
Everything in the OS is securable with an ACL - files, folders, ...
9
The question is a bit hard for me to decipher, but I am going to assume you are considering authenticating users by having the user present a username and password, and also having the user authenticate with a private key (client cert) that is stored on the user's device.
Short answer: yes, this is generally beneficial. If the user authenticates by both a ...
7
Having done the same mistake myself a couple of years ago:
Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all.
For LDAP, however, the common case is that the ...
7
I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin ...
5
I'm not sure your security expectations here are realistic.
If someone gets access to your DC in such a way that allows them to change arbitrary account passwords, then you've got plenty of bigger problems to worry about.
If they could re-boot the system in order to force their password change to take effect (after which point, your hypothetical additional ...
5
You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...
4
The answer to this depends on exactly how you'd like to see/manage this data. My recommendation would be PowerShell to get all of this.
If you do choose to user PowerShell, you can either use the native AD Cmdlets or Quest's free Cmdlets (http://www.quest.com/powershell/activeroles-server.aspx). To use the native Cmdlets, you must have at least one ...
4
Most places use radius in combination with a backend authentication system.
Freeradius could do the job and integrates with Active Directory: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO
Cisco ACS can do the job and also integrates with AD, though in my experience this can be cludgey. It supports policies and of course can ...
4
The answer is simple: do not allow Domain Admins. Give access to specific functions to specific people who are in the job of administration. The "Domain Admin" group should be empty with alerts when a user is added to this group.
In small teams, this might be a little tricky, but you can include people outside of the IT admin staff for oversight, and you ...
4
1- Is it possible to force actions like "reset password" to require the approval of more than a single administrator?
Its good idea to separate the creation of users from password reset, you could assign user creation to an admin, and leave the password reset to Help Desk for example.
In active directory you don't need domain admin to create users, you ...
4
The biggest reason I can think of as to why they might want to use RC4 is because of compatibility with Jira (and or this custom auth backend that we cannot vet.)
AES128 support was introduced along with Server 2008 and Vista, and AES256 with 2008 R2 and Win7. However, the KDC will automatically negotiate down to (for instance) RC4 when talking to, say, a ...
3
In worst case an attacker can run query of his choice in LDAP directory. Results may differ but definitely you don't want attacker to do this.
If you are using .NET framework, you could use AntiXSS library. I know that LDAP injection is not XSS, nevertheless XSS is also a form of injection and correct way to prevent this kind of vulnerabilities is to ...
3
Assuming all your accounts are stored in Active Directory, and only AD, and you will not accept any account registered at an external provider, it's hard to see additional benefit of simply using OAuth solely as the protocol to authenticate* users registered on your AD.
OAuth has a different use-case, it is designed to fit for federation scenarios:
...
3
I see that Stanford is using it as part of their bitlocker system recovery process Stanford link
For computers that are part of the Stanford Windows Infrastructure, a copy of the recovery password is stored with the computer object as a confidential attribute. By default, only Domain Administrators can see confidential attributes, no matter what access ...
3
Besides the very basic rule of "don't store credentials in configuration files"...
I'm not entirely sure what the development team was thinking, but you can use Forms Authentication with SSRS: http://technet.microsoft.com/en-us/library/ms152899.aspx.
It is a pretty hairy design, especially if its designed to continue using SQL to store the users. Now, ...
3
The historical password hashes are stored in the SAM along with your current one, so are certainly equally breakable.
I used to run password strength audits for large financials, and part of the output would be analysis of the number of individuals who reused passwords with just a change to the final digit (guess how large a percentage does it!) PWDump and ...
3
Mitigation 1: Use two-factor authentication, for logging into admin accounts.
Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...
3
No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP.
Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...
2
There is more than one way to configure auditing in Group Policy, but I think the primary old way (on Windows Server 2003) is to open GPMC, edit the Default Domain Policy (or whatever domain policies are active in the OU and objects you're working with), and drill down from the Policies node through Windows Settings to Security Settings, in order to open the ...
2
It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure each user account in AD for certificates. You don't have to modify IIS if you are planning on doing just Windows auth, but if you want mutual auth in IIS with ...
2
Years ago I worked at a school board of 40,000+ users/staff, and each user had an AD account.
There was an Identity Management System in place, so the student records would populate AD. As long as the records were in the student system in a given state, the students existed in AD, but disabled if they had graduated, or whatever. Once the state of the ...
2
Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!)
As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol.
For ...
2
Your certificate is stored on the computer, probably encrypted with the user's password. So to access the OWA account, one must have
The username (probably pre-filled at logon or easy to find)
The password
The computer where the certificate is stored.
The problem (+1 to @D.W. who mentionned it already) is that the computer keystore is hardly tamper ...
2
When you call SignData() or VerifyData(), you must specify which hash function to use (because signatures operate on hashed messages). Moreover, with RSA specifically as described by PKCS#1, the hash value is encapsulated inside a structure which contains the object identifier (OID) of the hash function. The invoked method must thus map the provided hash ...
2
If an administrator is going to type in his password on a hostile workstation, then he's effectively telling the user (or a hacker) his password, whether he sees it that way or not. This is very definitely a well-known and used exploit pathway, and I've even witnessed it used in the real world at IBM.
There's really only two options here:
Don't allow ...
2
If there is a trust relationship already established Kerberos is used.
NTLM is used when
authenticating to a machine using an IP address
if the machine is in a different forest that is using NTLM
the target machine isn't in the domain
the machines are not on the domain
if firewalls block the kerberos traffic
Microsoft has information on their use of ...
2
I assume you're concerned about Domain Users using the default privilege to add up to 10 workstations to the domain, without Domain Admin permission.
To control who has access to add users to the domain, edit this Local Security policy on the DC
Computer Configuration | Windows settings | Security Settings | User Rights Assignment | Add Workstations to ...
1
On a general basis, you cannot enforce a constraint such as "should be used only for smartcard logon". This is supposed to be the role of the Extended Key Usage certificate extension; see RFC 5280, section 4.2.1.12:
If the extension is present, then the certificate MUST only be used
for one of the purposes indicated.
But this relies on all ...
1
The following factors are possible for an authentication:
Something you know.
Something you own.
Something you are.
Something you know can be a password or a pin. Something you own can be a token like a Smart Card or a soft PSE like a PKCS12 file containing a private key and a certificate. Something you are is a biometric attribute like a finger print or ...
Only top voted, non community-wiki answers of a minimum length are eligible
