Skip to main content

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
1 answer
595 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
user1733655's user avatar
3 votes
0 answers
308 views

Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?

When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
purple-explorer's user avatar
3 votes
0 answers
103 views

Active directory configuration on a shared remote workplace environment

Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
Geert Bellekens's user avatar
3 votes
0 answers
118 views

What risks are associated with SPO/Onedrive/O365 external user accounts in active directory?

We've recently started using O365/SPO/OneDrive for business as a sharing platform over a previous niche provider platform. I've noticed that each time a user shares content externally, the external ...
Karlhuna's user avatar
  • 153
2 votes
0 answers
64 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
2 votes
0 answers
238 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
2 votes
0 answers
500 views

Active Directory and External Email Accounts

In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. [email protected] Within the same AD we also have '...
TheOrdinaryGeek's user avatar
2 votes
0 answers
2k views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
Vera Fodor's user avatar
2 votes
0 answers
1k views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
Onyx's user avatar
  • 21
2 votes
0 answers
171 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
Ob1lan's user avatar
  • 123
2 votes
0 answers
137 views

Determine Origin of AD Group Membership Addition

I am working on a potential issue internally where someone has access to add users to groups for email distribution purposes. I've recently been finding that their AD help desk group has the ...
Sqrl's user avatar
  • 21
2 votes
0 answers
1k views

Active directory, limit permission on ldap, allow only to read self profile

Is possible to limit the visibility of a standard LDAP user? I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile. I tried to apply ...
Ivano's user avatar
  • 71
1 vote
1 answer
393 views

What information is contained in the local SAM in an Active Directory network

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine? I understand (and correct me if I'm wrong) that when logging in to ...
user2334659's user avatar
1 vote
0 answers
278 views

Pass the hash/ pass the ticket TO a linux machine

I'm studying how to attack AD, but so far I have seen how to use pass the hash and pass the ticket to get access to Windows machines. How does one attack Linux machines joined to the domain using the ...
jagghy's user avatar
  • 11
1 vote
0 answers
810 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
John's user avatar
  • 11
1 vote
0 answers
248 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
1 vote
0 answers
178 views

Having Active Directory password length of more than 8 characters when that password is used to access mainframe systems

I am an intern with a Credit Union. I was surprised to find out that my Active Directory password length cannot be more than 8 characters. They use RACF for access to TSO or OMVS. I asked my mentor ...
user3063785's user avatar
1 vote
0 answers
541 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
nameless's user avatar
  • 129
1 vote
0 answers
207 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
Alexei's user avatar
  • 2,193
1 vote
0 answers
153 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
Jay 's user avatar
  • 71
1 vote
0 answers
261 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
awk's user avatar
  • 11
1 vote
1 answer
2k views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
Johan van Tonder's user avatar
1 vote
0 answers
1k views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
kuma's user avatar
  • 11
1 vote
0 answers
744 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
user1330734's user avatar
1 vote
0 answers
1k views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
daisy's user avatar
  • 2,077
1 vote
0 answers
338 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
DonHansDampf's user avatar
1 vote
0 answers
594 views

Auditing specific SAM_USER events in Windows 2012 R2 Active Directory

I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]". So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
Kilburn's user avatar
  • 11
1 vote
0 answers
1k views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
BZink's user avatar
  • 130
1 vote
0 answers
433 views

IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?

If I have an ASP.net web app set up to use windows authentication only on IIS, does it follow that any authenticated user should have connected from a machine that's joined to the domain? Does it ...
user avatar
1 vote
0 answers
85 views

Detecting Active Directory group access?

Is it possible to detect granular access to a particular AD group, rather than simply domain access? That is, if I am a member of 2 AD groups - GR_Read_HR, and GR_Write_Finance, is it possible to ...
M. Ferris's user avatar
  • 111
1 vote
0 answers
866 views

Is it possible to allow anonymous users to access part of an Azure website which uses Active Directory

I have a website hosted in Azure that uses Active Directory to prevent anyone from accessing it except for a few test users. Now I would like to expose a single page so that anyone can access it. I've ...
Joshua Barker's user avatar
1 vote
0 answers
329 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
rhymsy's user avatar
  • 1,212
1 vote
0 answers
129 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
Joseph Midas's user avatar
1 vote
0 answers
129 views

Does Active Directory Certificate Services support Card Verifiable Certificates?

Does Active Directory Certificate Services support accepting requests for, and generation of, Card Verifiable Certificates (TR-03110)? If so, in which version of Windows Server was the functionality ...
user3405828's user avatar
0 votes
0 answers
147 views

Impossible NTLMv2 hash format with Responder lm option

While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
Joy's user avatar
  • 1
0 votes
0 answers
63 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
rominator007's user avatar
0 votes
1 answer
135 views

It is possible to receive ntlm response with ipv6. What about ipv4?

I performed ntlm relay attack with mitm6 and ntlmrelayx. I used mitm6 for dns spoofing. When the victim sent a query containing where the DHCP is located, I identified myself as the DHCP server. Then ...
Firat's user avatar
  • 13
0 votes
0 answers
123 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
0 votes
1 answer
177 views

Shadow Credentials attack with TGT and TGS

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to: Use Whisker to create a new certificate on behalf of DC (successful): Whisker.exe add /...
Teodor Cristian's user avatar
0 votes
0 answers
84 views

Surreptitiously surveil a logged out laptop AD workstation's keyboard with temporary physical access?

I can think of multiple ways to surveil a logged out computer with temporary physical access. The first is installing a hardware keylogger which would enable one to get all the keystrokes from it; ...
Seci Pedia's user avatar
0 votes
0 answers
142 views

Get exhaustive domain user rights on domain with Powerview/Powersploit

I am connected to a Windows workstation with a basic domain user account. I have downloaded and installed Powersploit. I have also tried with Powerview. There is a command called Get-DomainObjectAcl. ...
Bob5421's user avatar
  • 51
0 votes
0 answers
228 views

Sharphound / Bloodhound full enumeration

I am working with Sharphound / Bloodhound tools to create a "map" of my active directory domain. It works fine. I have now a complex environment. There are multiple domains/forests. There is ...
Bob5421's user avatar
  • 51
0 votes
0 answers
876 views

Encryption of NTDS.dit (BOOTKEY)

Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
lara400's user avatar
  • 153
0 votes
1 answer
636 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
thomas's user avatar
  • 101
0 votes
0 answers
69 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
NRA's user avatar
  • 1
0 votes
0 answers
474 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
TomS's user avatar
  • 101
0 votes
0 answers
412 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
Vojtěch Dohnal's user avatar
0 votes
0 answers
303 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
Onyx's user avatar
  • 21
0 votes
0 answers
135 views

Apply policy to specific users OR computers

I was directed to post my question here from stackoverflow. Need some guidance implementing a policy. Specifically a block removable storage policy. Let's say I have 100 computers named PC1-PC100. PC1-...
Chocobits's user avatar
0 votes
1 answer
369 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
user134167's user avatar