Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
-1
votes
0answers
43 views

Employee ID instead of employee names for corporate login?

Our Active Directory logins are currently e.g. john.smith@mycompany.com (i.e. the same as our email addresses). A friend said his company uses numbers for login (e.g. 90210@mycompany.com) for security ...
0
votes
1answer
29 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
0
votes
0answers
56 views

Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?

Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
0
votes
1answer
117 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
0
votes
0answers
35 views

Equivalence of UNC Path Injection and Kerberoasting Attacks on SQL Server

An Active Directory domain is deployed, a domain controller on Windows Server 2019. A computer with SQL Server 2016 is added to it, which is launched under the srv service account. The attacker has ...
0
votes
0answers
51 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
5
votes
1answer
570 views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
0
votes
0answers
72 views

Trying to reproduce petitpotam exploit, got "KDC_ERROR_CLIENT_NOT_TRUSTED (62)" error

I'm following this article to reproduce the EFS bug: https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory/ My environment: Windows 2016 AD (...
1
vote
1answer
70 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
0
votes
0answers
129 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
0answers
43 views

What are the security risks when doing domain migration of users and computers?

We are moving users and computers/servers from an old domain to a new one within our company. The domains are managed using Active Directory. What are the security risks, considerations, and controls ...
0
votes
0answers
47 views

Is there a way to bypass Azure AD when iframing a website?

I'm currently doing a dynamic security evaluation on a website using Azure AD for login. Initial scans show that the X-frame options header is not set. Obviously, this will be reported at the very ...
0
votes
1answer
83 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
0
votes
0answers
113 views

Does azurevpnconfig (Azure) contain security-relevant information?

I created a new VPN gateway inside my Azure environment (OpenVPN SSL with AD authentication). After that, I downloaded the profile/config file which contains azurevpnconfig. With this file, the ...
0
votes
1answer
62 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
0
votes
1answer
86 views

Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits

RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed. An other scenario would be to ...
0
votes
0answers
47 views

Are there specific reasons why ADFS certificates are generated for 2 years?

Azure Active Directory generates certificates for federated SSO that have a lifespan of 3 years. in the case of an on premises AD, this is two years by default, and can be changed. Are there any ...
1
vote
0answers
56 views

Having Active Directory password length of more than 8 characters when that password is used to access mainframe systems

I am an intern with a Credit Union. I was surprised to find out that my Active Directory password length cannot be more than 8 characters. They use RACF for access to TSO or OMVS. I asked my mentor ...
0
votes
0answers
61 views

Permissions for reading password hashes in AD

We've been using the SpecOps Password Audit tool in our company for a while now and I'd like to give a junior member of our security team access. Unfortunately, the tool needs Domain Admin access to ...
0
votes
1answer
248 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
1
vote
1answer
116 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
1
vote
1answer
85 views

Ways to exploit AD in context of Domain Computer account not as Domain user account?

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account. Now I ...
2
votes
1answer
100 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
2
votes
0answers
338 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
1
vote
0answers
159 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
0
votes
0answers
63 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
1
vote
0answers
36 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
1
vote
1answer
123 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
1
vote
0answers
72 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
0
votes
0answers
43 views

Should one Windows Server serve both high and low trust devices?

The high and low-trust devices themselves are separated by VLANs, however they both need to be connected to an Active Directory. The only way for the low-trust VLAN to access the high-trust VLAN would ...
0
votes
1answer
151 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
1answer
2k views

Is it possible make a Pass-The-Hash attack with Responder?

The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2. The attack Pass-The-Hash permits ...
0
votes
0answers
63 views

Apply policy to specific users OR computers

I was directed to post my question here from stackoverflow. Need some guidance implementing a policy. Specifically a block removable storage policy. Let's say I have 100 computers named PC1-PC100. PC1-...
2
votes
1answer
199 views

Login with AD credentials on behalf of a user

We have a web solution (running in IIS) where AD users and non-AD users need to log into. We sell this to companies and will run this on-prem only. non-AD-FS and only AD question (so no federation) I ...
2
votes
2answers
97 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0
votes
1answer
396 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
1
vote
1answer
109 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
1
vote
0answers
43 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
0
votes
2answers
4k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
0
votes
1answer
139 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
0
votes
1answer
1k views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
1
vote
0answers
863 views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
2
votes
0answers
105 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
1
vote
1answer
236 views

How do companies authenticate internal users in internal systems?

Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
3
votes
1answer
1k views

Active Directory Pentesting Methodologies

I would like to ask about steps and methodologies for Active Directory pentesting. I used tools like responder, powerview, pingcastle and mimikatz, but maybe there are other methods that are useful.
0
votes
0answers
50 views

critical files to be monitored by file integrity monitoring solutions in active directory servers

We are implementing file integrity solution on Microsoft active directory servers, I need to know the critical paths(files and folders and registry keys) that need to be monitored for any change or ...
3
votes
1answer
239 views

Lateral Movement: What is the benefit of Windows Hello For Business?

I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up ...
0
votes
1answer
158 views

Identity management in a mixed Linux/Windows environment

At places like Google, where some users use Linux and others use Windows and even Mac, how are they managing IDAM? For example have a single directory service (probably highly customised)? is it ...
0
votes
0answers
58 views

Security and distro list naming convention in AAD

Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly. I am ...
0
votes
1answer
117 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...

1
2 3 4 5