Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

DMZ and ActiveDirectory users [migrated]

I start by saying that I am not really familiar with AD and DMZs. In my company, we have a DMZ with one server, isolated from the internal network (only a few open ports) and exposed to the web. There ...
1
vote
2answers
74 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
1
vote
1answer
60 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
2
votes
1answer
60 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
1
vote
0answers
25 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
0
votes
2answers
420 views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
0
votes
1answer
72 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
0
votes
1answer
238 views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
0
votes
0answers
65 views

how to exploit user which I own according to bloodhound?

During a pentest, I succeeded to compromize a user with low privileges. As this is a domain user, I decided to run BloodHound based on its credentials to check whether there is a path from this user ...
1
vote
0answers
212 views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
0
votes
0answers
45 views

How can Lingering Object Liquidator be used on a penetration test

How can Microsoft's Lingering Object Liquidator be used as part of a penetration test? I am a junior penetration tester, and saw a discussion between more senior pentesters discussing using LOL to get ...
2
votes
0answers
93 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
0
votes
0answers
245 views

CORS issue with WebApp on Azure + AAD

I would like to get some experts' advice regarding the way I resolved the following issue: Let's say my personal app is hosted as an Azure App Service on https://example.azurewebsites.net The JS ...
1
vote
1answer
187 views

How do companies authenticate internal users in internal systems?

Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
3
votes
1answer
858 views

Active Directory Pentesting Methodologies

I would like to ask about steps and methodologies for Active Directory pentesting. I used tools like responder, powerview, pingcastle and mimikatz, but maybe there are other methods that are useful.
0
votes
0answers
27 views

critical files to be monitored by file integrity monitoring solutions in active directory servers

We are implementing file integrity solution on Microsoft active directory servers, I need to know the critical paths(files and folders and registry keys) that need to be monitored for any change or ...
2
votes
1answer
69 views

Lateral Movement: What is the benefit of Windows Hello For Business?

I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up ...
0
votes
0answers
27 views

Exploiting Weak Permissions on OU in Active Directory?

I created an environment, where I allowed a user named demop with these four permissions CreateChild ListChildren ReadProperty GenericWrite on an OU named VulnerableOU? And, I have Meterpreter ...
0
votes
1answer
63 views

Identity management in a mixed Linux/Windows environment

At places like Google, where some users use Linux and others use Windows and even Mac, how are they managing IDAM? For example have a single directory service (probably highly customised)? is it ...
0
votes
0answers
30 views

Security and distro list naming convention in AAD

Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly. I am ...
0
votes
1answer
72 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
1
vote
1answer
265 views

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. ...
0
votes
0answers
120 views

Azure AD subdomains best practice

I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
0
votes
0answers
38 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
0answers
25 views

AD Security Group hunting

I have a problem that I have been pondering off and on for a while and I want to see if anyone has a better answer: Is there a way to see where an AD security group is used in an enterprise WITHOUT ...
0
votes
1answer
134 views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
1
vote
1answer
72 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
1
vote
0answers
181 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
1answer
88 views

AD user recreation, security issue

I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account. I've personally ...
4
votes
1answer
190 views

ActiveDirectory PenTest Help [closed]

I'm popped in the middle of the domain with what appears to be a VERY solid network. Good policy, good security, a lot of the usual tactics won't work. I cant pass-the-hash, find any SYSVOL loot, or ...
0
votes
0answers
58 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
3
votes
0answers
61 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
62 views

Execute internal penetration test without touching Active Directory

I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year. This quarter, we've received buy-in from all org ...
1
vote
1answer
70 views

What is the logic behind Microsoft recommending that creation of “god group” / Tier -0 in their Red Forest model for AD?

Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.
1
vote
0answers
251 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
1answer
102 views

Running jobs as local administrator vs domain administrator and their risks

I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
0
votes
1answer
304 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
1
vote
0answers
381 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
1
vote
0answers
71 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
0
votes
1answer
693 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
4
votes
1answer
241 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
1
vote
1answer
287 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
0
votes
0answers
63 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
3
votes
1answer
144 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
1
vote
1answer
3k views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
1
vote
1answer
76 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
64 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
2answers
396 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
1answer
1k views

MS Active Directory vs OpenId Connect?

I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally. But I have heard ...
2
votes
2answers
398 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...

1
2 3 4 5