Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Authorizing Access using AD with an API Gateway

We are developing a system that comprises of Component A: Client Application Component B: Gateway API Component C: Backend Web API providing functionality (will be a set of microservices C1, C2 etc) ...
  • 1
0 votes
0 answers
11 views

Do using Invoke-Command with a domain admin account create a security issue?

Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
  • 1
0 votes
0 answers
12 views

Why the Active Directory App created using Visual Studio does not have any "Certificate & Secrets".. is this fine?

I created a new ASP.NET Core 6.0 MVC web application, and I define it to use Azure AD for authentication, as follows: Then I was asked to create an owned application, so I created one named "ad&...
0 votes
0 answers
53 views

Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function

We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes). Now for this Azure Function to integrate with SharePoint, we have created an ...
0 votes
1 answer
123 views

Renewing Enterprise CA certificate

I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate. My setup is the Root CA is offline with online issuing CA server. When I do the renewal nothing ...
1 vote
1 answer
90 views

Why do I see LM hashes stored in Active Directory?

I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command: lsadump::dcsync /user:mimikatz The user's password is Pa55w.rd. The output is ... Credentials:...
  • 364
0 votes
0 answers
21 views

How to leverage GenericAll privilege on a machine account without RBCD?

Suppose a domain user has a GenericAll permission on a machine account, but the computer tied to that machine account is inaccessible, and that same machine account has a GenericAll privilege over a ...
2 votes
0 answers
66 views

Active Directory and External Email Accounts

In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. john@example.com Within the same AD we also have '...
2 votes
0 answers
266 views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
0 votes
0 answers
17 views

Minimal permissions required to resolve Guid of Active Directory Object

As part of an application that I'm writing, I attempt to resolve an active directory object from Guid to the object's Distinguished name. For some restricted objects, I must grant my service account ...
2 votes
0 answers
55 views

Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?

When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
1 vote
1 answer
43 views

Web app architecture- set a new password for a on-premises AD setup

I need to implement a web app for a self-service change password use case for on-premise Active Directory users, which is accessible over the internet. The service must allow the users to set a new ...
  • 111
0 votes
2 answers
56 views

Granting Local Admin permissions on domain workstations

We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
0 votes
0 answers
24 views

Smardcard-Login and LDAP-Webinterfaces

If "smartcard required" is ticked in an active directory user account the password is wiped. In my enviroment there are a lot of applications with webinteface logins connected via ldap to AD....
0 votes
1 answer
33 views

How to prevent a user retaining file access with an open handle on Windows?

Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group. Then, the user stops being a member of the group. Since access checks are ...
  • 4,610
0 votes
0 answers
92 views

Granting access to a Powershell script to read Windows Security event log (which approach is better?)

I want to be aware of any audit failure without installing any special service for some tiny network. So, I created PowerShell script with Get-EventLog and Send-MailMessage and installed it as ...
0 votes
0 answers
276 views

SAMR Forensic Investigation

I am currently investigating on suspicious SAMR request on a specific domain. From my knowledge, SAMR (i.e. SAM Request) is the act to ask directly a Domain Controller in order to take information, ...
4 votes
1 answer
214 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
0 votes
1 answer
101 views

Should a standard user in a AD domain be able to open cmd prompt as Administrator?

I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
  • 115
1 vote
0 answers
297 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
  • 11
0 votes
0 answers
21 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
  • 1
1 vote
0 answers
90 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
0 votes
1 answer
294 views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
0 votes
0 answers
22 views

Abusing Saved mscash2 Credentials in Active Directory

Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
0 votes
0 answers
155 views

Kerberos TGT behavior after password change

I just want to confirm behavior of Kerberos and how the tickets work, as I only have a basic understanding. From what it sounds like, the user's password hash is only used to gain the initial TGT. ...
3 votes
0 answers
62 views

Active directory configuration on a shared remote workplace environment

Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
1 vote
3 answers
851 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
0 votes
1 answer
253 views

Why AD Kerberos uses password hash and not session key for tickets?

There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/ I ask TGS for ticket to access some SPN Part of this ticket is encrypted with ...
1 vote
1 answer
792 views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
  • 79
0 votes
1 answer
73 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
  • 101
0 votes
1 answer
319 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
  • 101
0 votes
0 answers
250 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
  • 101
5 votes
1 answer
2k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
1 vote
1 answer
479 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
0 votes
0 answers
259 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0 votes
1 answer
195 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
0 votes
1 answer
97 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
0 votes
1 answer
329 views

Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits

RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed. An other scenario would be to ...
  • 1
1 vote
0 answers
113 views

Having Active Directory password length of more than 8 characters when that password is used to access mainframe systems

I am an intern with a Credit Union. I was surprised to find out that my Active Directory password length cannot be more than 8 characters. They use RACF for access to TSO or OMVS. I asked my mentor ...
1 vote
1 answer
670 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: NTLM auth starts with a negotiation packet sent by the client. In this ...
1 vote
1 answer
365 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
1 vote
1 answer
304 views

Ways to exploit AD in context of Domain Computer account not as Domain user account?

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account. Now I ...
2 votes
1 answer
151 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
  • 25
2 votes
0 answers
791 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
  • 21
1 vote
0 answers
395 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
  • 131
0 votes
0 answers
145 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
  • 21
1 vote
0 answers
101 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
  • 2,183
1 vote
1 answer
185 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
  • 13
1 vote
0 answers
112 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
  • 71
0 votes
1 answer
306 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...

1
2 3 4 5