Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

1
vote
0answers
16 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
0
votes
0answers
11 views

Tool for checking credentials across entire network of Windows hosts? [closed]

I'm looking for a tool to check a set of credentials against a network of Windows hosts, preferably using CIDR notation (/XX). I know of CrackMapExec, but I would prefer another tool. I've been ...
0
votes
1answer
37 views

how can I check if crackmapexec is noisy? [on hold]

I would like if someone could give me a hand with this tool called crackmapexec. I want to know in those cases of red teaming when we only have one opportunity to pwn all the comapny at the moment to ...
0
votes
0answers
32 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
1answer
52 views

Obtaining plain-text passwords from a Domain Controller [on hold]

Is there anyway to log the plaintext passwords of accounts that authenticate against a domain controller? I know most of the Mimikatz attacks and they all recover credentials from memory, but they're ...
0
votes
0answers
17 views

Why lsadump is not working?

I have a shell with root privileges, and I invoke mimikatz in it by using load kiwi in meterpreter shell. Now the problem I have facing is, I can't get the positive results. When I run this lsadump::...
0
votes
0answers
19 views

How to query sysvol?

I exploited a machine for ex:- client2 which is a part of dev.januapp.local. Now I can enumerate users, computers etc. And also I read that we should also check sysvol But I didn't find the way to see ...
2
votes
0answers
34 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
0
votes
1answer
68 views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
1
vote
1answer
46 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
0answers
17 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
2answers
189 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
0
votes
1answer
148 views

MS Active Directory vs OpenId Connect?

I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally. But I have heard ...
2
votes
2answers
116 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
4
votes
1answer
111 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
0answers
51 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
1
vote
2answers
213 views

Windows Servers in DMZ - managed via AD or standalone?

From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
-1
votes
3answers
187 views

How to limit Administrators by day of the week

I have 69 Administrators in AD and I have noticed they are doing all kinds of whacky (and untrustworthy) things. This is an audit nightmare, and I was wondering if there is a way to disable an Admin ...
0
votes
0answers
50 views

Machine and User Authentication in Active Directory

I need some authentication options for software that is usually deployed in AD, when a machine running the software registers in the environment/domain we want to be able to approve it, and select ...
1
vote
0answers
250 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
0
votes
0answers
270 views

Does LocalAccountTokenFilterPolicy registry value completely mitigate Windows pass-the-hash (PtH)?

I've been sitting for hours trying to get PsExec and windows/smb/psexec to work without luck, always getting the "Access is denied." error, until I came across the following article on Windows Vista: ...
1
vote
0answers
51 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
0
votes
0answers
230 views

Pen testing, Windows: Using credentials to impersonate users from SYSTEM

Following simple scenario during pen test: I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose) I ...
2
votes
0answers
42 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
2
votes
0answers
38 views

Determine Origin of AD Group Membership Addition

I am working on a potential issue internally where someone has access to add users to groups for email distribution purposes. I've recently been finding that their AD help desk group has the ...
2
votes
1answer
356 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
1
vote
1answer
68 views

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use ...
0
votes
1answer
275 views

Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?

I've been working on an intranet web application that provides read/write, role-based access to a database. I have been asked to configure the IIS application to use an AD account for the Application ...
1
vote
0answers
106 views

Auditing specific SAM_USER events in Windows 2012 R2 Active Directory

I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]". So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
1
vote
2answers
130 views

Active Directory DNS server security misconfiguration or an acceptable practice?

I work for a large Eastern European bank as a programmer. Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best ...
3
votes
1answer
70 views

External vendor has requested to join our Active Directory Domain

We've received a request from a vendor who wishes to join two computers from their network into our AD Domain. The vendor is proposing to provide a vertical application installed on their servers ...
5
votes
2answers
5k views

Recover the password of a Windows service user login account

When setting up a Windows service, one specifies a user account to use for authentication, as well as the password for that user. In their guidelines for user account selection, Microsoft states that ...
6
votes
2answers
390 views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
0
votes
1answer
520 views

Digital signatures in a corporate network

I'm going to implement digital signatures for corporate use. For that, I would develop an application for signatures, generate public/private keys for all employees and store private keys in the ...
3
votes
1answer
242 views

what does “HasSession” means in bloodhound tool [closed]

I'm exploring the Bloodhound Active Directory reconnaissance tool. There are few labels in this tool such as "AdminTo, MemberOf, HasSession" the first two is obvious to me. However, I didn't get the ...
0
votes
1answer
456 views

Password reset for AD RODC-specific krbtgt_xxxxx accounts

While there's a lot of information [1], [2], [3] about resetting the password for the regular krbtgt account, but I haven't yet found a clear suggestion about RODC-specific krbtgt_xxxxx accounts. ...
0
votes
0answers
113 views

Malware and Kerberos Authentication

Could malware use the active Kerberos ticket on the system to authenticate with AD and then proceed to successfully call the CnC server through the HTTP proxy on the same environment?
1
vote
1answer
142 views

Limit information disclosed in AD Anonymous Bind

What I am trying to do For reasons I may not go into, we must allow Anonymous Bind in AD on a private network. I am fully aware of the risks associated with this. I have found a myriad of ...
4
votes
3answers
354 views

Password Policy

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
0
votes
2answers
490 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
5
votes
0answers
57 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
1
vote
0answers
523 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
2
votes
1answer
3k views

Can I prevent Active Directory from accepting common passwords? [closed]

Active Directory's complexity requirements are rudimentary and I suspect this specific part of Windows security hasn't been improved in a decade or more. Is there a built-in or 3rd party tool ...
1
vote
2answers
151 views

Is there a security reason to disable a leavers account instead of deleting it? [duplicate]

Well the title says it all really. Obviously if they return it's easy to enable but I'm talking specifically about leavers where there is no intention of returning. Many places simply disable ...
1
vote
2answers
42 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
3
votes
1answer
3k views

How can I make my java application trust connection using a domain (self) signed certificate?

We have a windows AD domain with servers and clients. The domain also has a Windows Certificate Authority (AD CS). The CA is trusted in the domain by publishing it's public key in the local ...
2
votes
0answers
379 views

Active directory, limit permission on ldap, allow only to read self profile

Is possible to limit the visibility of a standard LDAP user? I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile. I tried to apply ...
0
votes
1answer
59 views

Implications of joining the active directory domain with the domain administrator

I always used the domain administrator to join the active directory domain, but I've never set up more than a few machines. Is that considered a security risk, is the end-user somehow able to obtain ...
0
votes
1answer
115 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
1
vote
0answers
227 views

IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?

If I have an ASP.net web app set up to use windows authentication only on IIS, does it follow that any authenticated user should have connected from a machine that's joined to the domain? Does it ...