Tag Info

New answers tagged

2

Did you query for the "any" DNS resource record (wildcard) type? (Otherwise the default is to simple query for A records. And the records in question are in fact SRV RRs.) Using dig: dig _ldap._tcp.dc._msdcs.Active_Directory_DNS_domain_name -t any Also you can simply ping the Active_Directory_DNS_domain_name and this will give you DC-IPs. (Because ...


1

The only reasons to create a separate AD domain is to have a different password policy, to segment replication. You can minimize risk of a compromised DC only by having a new forest. Any domain in a forest can result in compromised Enterprise Admin credentials. The ADFS server must be trusted by both domains, so a Domain trust or a forest trust is needed. ...


1

You can use Group Policy to install the certificate on the client machines. You will need to bind the certificate to your site through IIS/Apache to complete the process. Keep in mind that you will need to ensure that your internal CA is trusted by your internal clients. I think this is in fact reasonably secure, and one of the use cases that ...


0

The long way: Nmap the net. for topology, focus on red nodes for access to network using the port of your choice that is both open, associated with the red Nmap node and uses UDP. Migrate sideways once in to a node the Nmap showed as yellow (not required). Now that you are nested in the network, escalate privilege but don't become admin. you should be ...


0

Sniff for TCP or UDP 88 (Kerberos), amongst others Or if you have an account on the domain (just in case), from the command prompt run nltest /dclist:yourdomain.com



Top 50 recent answers are included