Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
3
votes
0answers
52 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
26 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
52 views

Execute internal penetration test without touching Active Directory

I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year. This quarter, we've received buy-in from all org ...
1
vote
1answer
65 views

What is the logic behind Microsoft recommending that creation of “god group” / Tier -0 in their Red Forest model for AD?

Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.
0
votes
0answers
30 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
1answer
42 views

Running jobs as local administrator vs domain administrator and their risks

I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
0
votes
1answer
78 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
1
vote
0answers
75 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
1
vote
0answers
24 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
0
votes
1answer
160 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
4
votes
1answer
117 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
1
vote
1answer
79 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
0
votes
0answers
41 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
0
votes
0answers
46 views

Why lsadump is not working?

I have a shell with root privileges, and I invoke mimikatz in it by using load kiwi in meterpreter shell. Now the problem I have facing is, I can't get the positive results. When I run this lsadump::...
0
votes
0answers
38 views

How to query sysvol?

I exploited a machine for ex:- client2 which is a part of dev.januapp.local. Now I can enumerate users, computers etc. And also I read that we should also check sysvol But I didn't find the way to see ...
2
votes
0answers
58 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
1
vote
1answer
578 views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
1
vote
1answer
52 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
49 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
2answers
288 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
1answer
560 views

MS Active Directory vs OpenId Connect?

I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally. But I have heard ...
2
votes
2answers
220 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
4
votes
1answer
134 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
0answers
79 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
2
votes
2answers
750 views

Windows Servers in DMZ - managed via AD or standalone?

From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
-1
votes
3answers
188 views

How to limit Administrators by day of the week

I have 69 Administrators in AD and I have noticed they are doing all kinds of whacky (and untrustworthy) things. This is an audit nightmare, and I was wondering if there is a way to disable an Admin ...
1
vote
0answers
400 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
1
vote
0answers
98 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
0
votes
0answers
280 views

Pen testing, Windows: Using credentials to impersonate users from SYSTEM

Following simple scenario during pen test: I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose) I ...
2
votes
0answers
47 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
2
votes
0answers
38 views

Determine Origin of AD Group Membership Addition

I am working on a potential issue internally where someone has access to add users to groups for email distribution purposes. I've recently been finding that their AD help desk group has the ...
2
votes
1answer
507 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
2
votes
1answer
80 views

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

I would like to understand the real role of 2-Factor Authentication in Industry Control Systems like SCADA/SmartGrid with Windows AD infrastructure. In particular I am interested in an operational use ...
0
votes
1answer
447 views

Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?

I've been working on an intranet web application that provides read/write, role-based access to a database. I have been asked to configure the IIS application to use an AD account for the Application ...
1
vote
0answers
174 views

Auditing specific SAM_USER events in Windows 2012 R2 Active Directory

I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]". So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
1
vote
2answers
158 views

Active Directory DNS server security misconfiguration or an acceptable practice?

I work for a large Eastern European bank as a programmer. Recently, I was setting up a documentation website for my team. We came up with the host name, and now all we needed was to pick the best ...
3
votes
1answer
73 views

External vendor has requested to join our Active Directory Domain

We've received a request from a vendor who wishes to join two computers from their network into our AD Domain. The vendor is proposing to provide a vertical application installed on their servers ...
6
votes
2answers
8k views

Recover the password of a Windows service user login account

When setting up a Windows service, one specifies a user account to use for authentication, as well as the password for that user. In their guidelines for user account selection, Microsoft states that ...
6
votes
2answers
565 views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
0
votes
1answer
780 views

Digital signatures in a corporate network

I'm going to implement digital signatures for corporate use. For that, I would develop an application for signatures, generate public/private keys for all employees and store private keys in the ...
3
votes
1answer
362 views

what does “HasSession” means in bloodhound tool [closed]

I'm exploring the Bloodhound Active Directory reconnaissance tool. There are few labels in this tool such as "AdminTo, MemberOf, HasSession" the first two is obvious to me. However, I didn't get the ...
0
votes
1answer
576 views

Password reset for AD RODC-specific krbtgt_xxxxx accounts

While there's a lot of information [1], [2], [3] about resetting the password for the regular krbtgt account, but I haven't yet found a clear suggestion about RODC-specific krbtgt_xxxxx accounts. ...
1
vote
1answer
208 views

Limit information disclosed in AD Anonymous Bind

What I am trying to do For reasons I may not go into, we must allow Anonymous Bind in AD on a private network. I am fully aware of the risks associated with this. I have found a myriad of ...
4
votes
4answers
404 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
0
votes
2answers
564 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
4
votes
1answer
79 views

DSquery leaking personal infomation

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
1
vote
0answers
587 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
2
votes
1answer
4k views

Can I prevent Active Directory from accepting common passwords? [closed]

Active Directory's complexity requirements are rudimentary and I suspect this specific part of Windows security hasn't been improved in a decade or more. Is there a built-in or 3rd party tool ...
1
vote
2answers
178 views

Is there a security reason to disable a leavers account instead of deleting it? [duplicate]

Well the title says it all really. Obviously if they return it's easy to enable but I'm talking specifically about leavers where there is no intention of returning. Many places simply disable ...