2022 Developer Survey is open! Take survey.

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
user avatar
  • 1
0 votes
0 answers
26 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
user avatar
0 votes
1 answer
32 views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user avatar
0 votes
0 answers
9 views

Abusing Saved mscash2 Credentials in Active Directory

Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
user avatar
0 votes
0 answers
17 views

Kerberos TGT behavior after password change

I just want to confirm behavior of Kerberos and how the tickets work, as I only have a basic understanding. From what it sounds like, the user's password hash is only used to gain the initial TGT. ...
user avatar
3 votes
0 answers
61 views

Active directory configuration on a shared remote workplace environment

Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
user avatar
1 vote
3 answers
198 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
user avatar
0 votes
1 answer
89 views

Why AD Kerberos uses password hash and not session key for tickets?

There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/ I ask TGS for ticket to access some SPN Part of this ticket is encrypted with ...
user avatar
1 vote
1 answer
275 views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
user avatar
  • 79
0 votes
1 answer
64 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
user avatar
  • 101
0 votes
0 answers
186 views

Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?

Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
user avatar
0 votes
1 answer
218 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
user avatar
  • 101
0 votes
0 answers
95 views

Equivalence of UNC Path Injection and Kerberoasting Attacks on SQL Server

An Active Directory domain is deployed, a domain controller on Windows Server 2019. A computer with SQL Server 2016 is added to it, which is launched under the srv service account. The attacker has ...
user avatar
  • 13
0 votes
0 answers
107 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
user avatar
  • 101
6 votes
1 answer
1k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
user avatar
0 votes
0 answers
248 views

Trying to reproduce petitpotam exploit, got "KDC_ERROR_CLIENT_NOT_TRUSTED (62)" error

I'm following this article to reproduce the EFS bug: https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory/ My environment: Windows 2016 AD (...
user avatar
  • 1,675
1 vote
1 answer
120 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
user avatar
0 votes
0 answers
178 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
user avatar
0 votes
0 answers
78 views

What are the security risks when doing domain migration of users and computers?

We are moving users and computers/servers from an old domain to a new one within our company. The domains are managed using Active Directory. What are the security risks, considerations, and controls ...
user avatar
0 votes
0 answers
93 views

Is there a way to bypass Azure AD when iframing a website?

I'm currently doing a dynamic security evaluation on a website using Azure AD for login. Initial scans show that the X-frame options header is not set. Obviously, this will be reported at the very ...
user avatar
  • 173
0 votes
1 answer
130 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
user avatar
0 votes
0 answers
241 views

Does azurevpnconfig (Azure) contain security-relevant information?

I created a new VPN gateway inside my Azure environment (OpenVPN SSL with AD authentication). After that, I downloaded the profile/config file which contains azurevpnconfig. With this file, the ...
user avatar
0 votes
1 answer
89 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
user avatar
0 votes
1 answer
186 views

Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits

RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed. An other scenario would be to ...
user avatar
  • 1
0 votes
0 answers
82 views

Are there specific reasons why ADFS certificates are generated for 2 years?

Azure Active Directory generates certificates for federated SSO that have a lifespan of 3 years. in the case of an on premises AD, this is two years by default, and can be changed. Are there any ...
user avatar
  • 8,923
1 vote
0 answers
87 views

Having Active Directory password length of more than 8 characters when that password is used to access mainframe systems

I am an intern with a Credit Union. I was surprised to find out that my Active Directory password length cannot be more than 8 characters. They use RACF for access to TSO or OMVS. I asked my mentor ...
user avatar
0 votes
1 answer
410 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
user avatar
1 vote
1 answer
204 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
user avatar
1 vote
1 answer
154 views

Ways to exploit AD in context of Domain Computer account not as Domain user account?

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account. Now I ...
user avatar
2 votes
1 answer
130 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
user avatar
  • 23
2 votes
0 answers
516 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
user avatar
  • 21
1 vote
0 answers
250 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
user avatar
  • 131
0 votes
0 answers
95 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
user avatar
  • 21
1 vote
0 answers
70 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
user avatar
  • 2,183
1 vote
1 answer
162 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
user avatar
  • 13
1 vote
0 answers
102 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
user avatar
  • 71
0 votes
1 answer
234 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
user avatar
1 vote
1 answer
2k views

Is it possible make a Pass-The-Hash attack with Responder?

The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2. The attack Pass-The-Hash permits ...
user avatar
  • 284
0 votes
0 answers
90 views

Apply policy to specific users OR computers

I was directed to post my question here from stackoverflow. Need some guidance implementing a policy. Specifically a block removable storage policy. Let's say I have 100 computers named PC1-PC100. PC1-...
user avatar
2 votes
1 answer
278 views

Login with AD credentials on behalf of a user

We have a web solution (running in IIS) where AD users and non-AD users need to log into. We sell this to companies and will run this on-prem only. non-AD-FS and only AD question (so no federation) I ...
user avatar
  • 123
2 votes
2 answers
124 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
user avatar
0 votes
1 answer
522 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
user avatar
2 votes
1 answer
142 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
user avatar
1 vote
0 answers
72 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
user avatar
  • 11
0 votes
2 answers
4k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
user avatar
0 votes
1 answer
175 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
user avatar
0 votes
1 answer
1k views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
user avatar
1 vote
0 answers
1k views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
user avatar
  • 11
2 votes
0 answers
132 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
user avatar
  • 123
1 vote
1 answer
278 views

How do companies authenticate internal users in internal systems?

Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
user avatar
  • 69

1
2 3 4 5