Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
2 votes
0 answers
84 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
0 votes
1 answer
31 views

Shadow Credentials attack with TGT and TGS

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to: Use Whisker to create a new certificate on behalf of DC (successful): Whisker.exe add /...
Teodor Cristian's user avatar
1 vote
0 answers
63 views

Oracle Kerberos authentication on Linux host with SSSD

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication. NOTE: this is not purely about ...
ibre5041's user avatar
1 vote
1 answer
56 views

What information is contained in the local SAM in an Active Directory network

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine? I understand (and correct me if I'm wrong) that when logging in to ...
user2334659's user avatar
1 vote
1 answer
235 views

Kerberos - NTLM Password Hashes - Questions!

I have worked as a system administrator mainly on Widnows Server for some years now. Over the course of time I've always had a hard time trying to fully understand how Kerberos work. For about 3 weeks ...
Matías Huartamendía's user avatar
0 votes
0 answers
36 views

Surreptitiously surveil a logged out laptop AD workstation's keyboard with temporary physical access?

I can think of multiple ways to surveil a logged out computer with temporary physical access. The first is installing a hardware keylogger which would enable one to get all the keystrokes from it; ...
Seci Pedia's user avatar
0 votes
1 answer
288 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
0 votes
0 answers
53 views

Get exhaustive domain user rights on domain with Powerview/Powersploit

I am connected to a Windows workstation with a basic domain user account. I have downloaded and installed Powersploit. I have also tried with Powerview. There is a command called Get-DomainObjectAcl. ...
Bob5421's user avatar
  • 49
0 votes
0 answers
77 views

Sharphound / Bloodhound full enumeration

I am working with Sharphound / Bloodhound tools to create a "map" of my active directory domain. It works fine. I have now a complex environment. There are multiple domains/forests. There is ...
Bob5421's user avatar
  • 49
0 votes
0 answers
35 views

simulating a domain user logon on machine startup

I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
s1gsegv's user avatar
0 votes
0 answers
347 views

Encryption of NTDS.dit (BOOTKEY)

Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
lara400's user avatar
  • 153
2 votes
1 answer
44 views

Can you use AD CS to generate certificates for service users with the computer name in the certificate details?

I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
AJ Henderson's user avatar
  • 42.1k
1 vote
0 answers
143 views

Pass the hash/ pass the ticket TO a linux machine

I'm studying how to attack AD, but so far I have seen how to use pass the hash and pass the ticket to get access to Windows machines. How does one attack Linux machines joined to the domain using the ...
jagghy's user avatar
  • 11
2 votes
0 answers
51 views

kerberoasting on a standard user domain account

Kerberoasting is an attack against domain service accounts. I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory ...
Bob5421's user avatar
  • 49
0 votes
0 answers
31 views

I want to join our organisation AD with a recently acquired company's AD for federated access. What are the security risks I should consider?

As per the title. What risks and controls should I consider? Are there any questions i need to ask the external party AD before setting up the 'Trust' between the 2 ADs?
Architect 's user avatar
0 votes
1 answer
264 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
thomas's user avatar
  • 101
0 votes
0 answers
83 views

Authorizing Access using AD with an API Gateway

We are developing a system that comprises of Component A: Client Application Component B: Gateway API Component C: Backend Web API providing functionality (will be a set of microservices C1, C2 etc) ...
PeeGee's user avatar
  • 1
0 votes
0 answers
108 views

Do using Invoke-Command with a domain admin account create a security issue?

Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
IT Guy's user avatar
  • 1
0 votes
0 answers
42 views

Why the Active Directory App created using Visual Studio does not have any "Certificate & Secrets".. is this fine?

I created a new ASP.NET Core 6.0 MVC web application, and I define it to use Azure AD for authentication, as follows: Then I was asked to create an owned application, so I created one named "ad&...
test test's user avatar
0 votes
0 answers
124 views

Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function

We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes). Now for this Azure Function to integrate with SharePoint, we have created an ...
test test's user avatar
0 votes
1 answer
2k views

Renewing Enterprise CA certificate

I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate. My setup is the Root CA is offline with online issuing CA server. When I do the renewal nothing ...
Julian Haines's user avatar
1 vote
1 answer
595 views

Why do I see LM hashes stored in Active Directory?

I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command: lsadump::dcsync /user:mimikatz The user's password is Pa55w.rd. The output is ... Credentials:...
Daniel's user avatar
  • 364
0 votes
0 answers
111 views

How to leverage GenericAll privilege on a machine account without RBCD?

Suppose a domain user has a GenericAll permission on a machine account, but the computer tied to that machine account is inaccessible, and that same machine account has a GenericAll privilege over a ...
Primarch's user avatar
2 votes
0 answers
297 views

Active Directory and External Email Accounts

In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. jo[email protected] Within the same AD we also have '...
TheOrdinaryGeek's user avatar
2 votes
0 answers
936 views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
Vera Fodor's user avatar
0 votes
0 answers
49 views

Minimal permissions required to resolve Guid of Active Directory Object

As part of an application that I'm writing, I attempt to resolve an active directory object from Guid to the object's Distinguished name. For some restricted objects, I must grant my service account ...
Eran Nahshon's user avatar
2 votes
0 answers
195 views

Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?

When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
purple-explorer's user avatar
1 vote
1 answer
82 views

Web app architecture- set a new password for a on-premises AD setup

I need to implement a web app for a self-service change password use case for on-premise Active Directory users, which is accessible over the internet. The service must allow the users to set a new ...
frhack's user avatar
  • 111
0 votes
2 answers
107 views

Granting Local Admin permissions on domain workstations

We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
RonMidwest's user avatar
0 votes
1 answer
42 views

How to prevent a user retaining file access with an open handle on Windows?

Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group. Then, the user stops being a member of the group. Since access checks are ...
user253751's user avatar
  • 4,891
4 votes
1 answer
387 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
Al Longley's user avatar
0 votes
1 answer
161 views

Should a standard user in a AD domain be able to open cmd prompt as Administrator?

I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
sxmad's user avatar
  • 115
1 vote
0 answers
616 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
John's user avatar
  • 11
0 votes
0 answers
28 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
NRA's user avatar
  • 1
1 vote
0 answers
146 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
0 votes
1 answer
824 views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user10433098's user avatar
3 votes
0 answers
69 views

Active directory configuration on a shared remote workplace environment

Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
Geert Bellekens's user avatar
1 vote
3 answers
2k views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
TheGreyShadow's user avatar
0 votes
1 answer
529 views

Why AD Kerberos uses password hash and not session key for tickets?

There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/ I ask TGS for ticket to access some SPN Part of this ticket is encrypted with ...
user996142's user avatar
1 vote
1 answer
2k views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
Bob's user avatar
  • 79
0 votes
1 answer
86 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
Dan's user avatar
  • 101
0 votes
1 answer
439 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
Manny's user avatar
  • 101
0 votes
0 answers
368 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
TomS's user avatar
  • 101
5 votes
1 answer
3k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
dcom-launch's user avatar
1 vote
1 answer
1k views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
skiriakidis's user avatar
0 votes
0 answers
332 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
Vojtěch Dohnal's user avatar
0 votes
1 answer
237 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
kudlatiger's user avatar
0 votes
1 answer
116 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
user211383's user avatar
0 votes
1 answer
478 views

Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits

RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed. An other scenario would be to ...
David's user avatar
  • 1

1
2 3 4 5 6