Skip to main content

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
66 votes
1 answer
8k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
Matt's user avatar
  • 3,252
39 votes
5 answers
21k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
Minaj's user avatar
  • 1,576
5 votes
1 answer
6k views

How does UNC path hardening and SMB signing work under the hood?

With a lot of unpatched versions of Windows in an Active Directory domain, one can man-in-the-middle a client when it connects to the domain controller and inject a group policy that gives an attacker ...
Volker's user avatar
  • 1,253
2 votes
3 answers
6k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
Sadeq Dousti's user avatar
  • 1,514
1 vote
2 answers
524 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
Brian Lyttle's user avatar
0 votes
2 answers
1k views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
k to the z's user avatar
  • 1,125
34 votes
4 answers
120k views

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? When do I need a RADIUS server?
johnny's user avatar
  • 641
23 votes
2 answers
17k views

Does Windows really still use unsalted MD4 for password storage?

I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm. Can it really be true? I've been ...
Richard Gadsden's user avatar
11 votes
4 answers
76k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
davidb's user avatar
  • 4,323
7 votes
5 answers
17k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username & ...
George Tsiokos's user avatar
7 votes
4 answers
10k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = WScript.CreateObject("...
makerofthings7's user avatar
7 votes
1 answer
8k views

What is the real risk from trusted forests / domains?

I am trying to identify specific attack vectors that occur due to domain/forest trust in Active Directory. Microsoft in their KB Articles Domain Trust, section "Considerations About Trusts" write that:...
Konrads's user avatar
  • 599
5 votes
2 answers
2k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
RailOcelot's user avatar
4 votes
4 answers
514 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
Chri3's user avatar
  • 327
4 votes
1 answer
1k views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
Robert Mennell's user avatar
2 votes
2 answers
2k views

How do I constrain Windows Smartcards for AD Authentication so that "anyExtendedKeyUsage" is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states “...
makerofthings7's user avatar
0 votes
2 answers
207 views

Compromised server name and port number of a SQL Server DB Server

I would like to get an expert opinion on how dangerous is it to have the database server name and SQL server instance and port number compromised by accidentally exposing it in source code snippet ...
Paceman's user avatar
  • 101