Skip to main content

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
66 votes
1 answer
8k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
Matt's user avatar
  • 3,252
39 votes
5 answers
21k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
Minaj's user avatar
  • 1,576
34 votes
4 answers
120k views

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? When do I need a RADIUS server?
johnny's user avatar
  • 641
23 votes
2 answers
17k views

Does Windows really still use unsalted MD4 for password storage?

I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm. Can it really be true? I've been ...
Richard Gadsden's user avatar
22 votes
4 answers
144k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
Ambar Batista's user avatar
17 votes
8 answers
17k views

Monitoring Active Directory Domain Administrator Activities

I need to monitor Active Directory domain administrator activities and look for the following: Looking for anomalies in daily activity Getting alerted upon a violation My problem is that turning on ...
Fahmy Aziz's user avatar
11 votes
4 answers
76k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
davidb's user avatar
  • 4,323
11 votes
3 answers
31k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
Andy's user avatar
  • 535
10 votes
3 answers
21k views

To DMZ, or not to DMZ

So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network. The 'networks' are: Internal network DMZ The internet And the servers we need ...
voluminat0's user avatar
9 votes
3 answers
12k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
Nic's user avatar
  • 1,146
9 votes
2 answers
3k views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
Namphibian's user avatar
9 votes
4 answers
6k views

Can an intruder still possibly succeed with pass-the-hash or pass-the-ticket on Windows 10 / Server 2016 networks where Credential Guard is enabled?

In sum: Does Credential Guard make passing-the-hash and passing-the-ticket attacks effectively unavailable on networks of Windows 10 / Windows Server 2016 machines? If not, how do you still acquire ...
mostlyinformed's user avatar
8 votes
1 answer
441 views

What practical uses are there for the AD feature of "Confidential Attributes"

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes? Would you store sensitive information here such as a private key, or a salt here? I'm ...
makerofthings7's user avatar
7 votes
5 answers
17k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username & ...
George Tsiokos's user avatar
7 votes
2 answers
3k views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
MDMarra's user avatar
  • 325
7 votes
2 answers
23k views

Recover the password of a Windows service user login account

When setting up a Windows service, one specifies a user account to use for authentication, as well as the password for that user. In their guidelines for user account selection, Microsoft states that ...
fuglede's user avatar
  • 173
7 votes
1 answer
3k views

Deploying a campus WiFi network that authenticates against an AD LDAP

We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
YerPhate's user avatar
  • 141
7 votes
2 answers
3k views

Extracting Individual Records from NTDS.DIT

I am working with an extremely large NTDS.DIT file. It is about 20gb. Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart ...
Sugitime's user avatar
  • 171
7 votes
1 answer
8k views

What is the real risk from trusted forests / domains?

I am trying to identify specific attack vectors that occur due to domain/forest trust in Active Directory. Microsoft in their KB Articles Domain Trust, section "Considerations About Trusts" write that:...
Konrads's user avatar
  • 599
7 votes
4 answers
10k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = WScript.CreateObject("...
makerofthings7's user avatar
6 votes
3 answers
16k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
Cyassin's user avatar
  • 525
6 votes
3 answers
6k views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
k to the z's user avatar
  • 1,125
6 votes
4 answers
7k views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
Jobe Woodmere's user avatar
6 votes
1 answer
9k views

Active Directory - Certificate Based Authentication - Multiple certificates for user

First, I have very limited knowledge about AD. Problem: I authenticating users on AD using user certificates. I want to authenticate user on various devices (including mobile devices). Each will ...
Manmay's user avatar
  • 161
6 votes
2 answers
30k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
KodeKreachor's user avatar
6 votes
1 answer
2k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
makerofthings7's user avatar
6 votes
2 answers
1k views

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications. I’ve devised a few ...
mythofechelon's user avatar
6 votes
1 answer
1k views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
Shuzheng's user avatar
  • 1,267
5 votes
4 answers
8k views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
Francis's user avatar
  • 51
5 votes
1 answer
4k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
dcom-launch's user avatar
5 votes
2 answers
11k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
makerofthings7's user avatar
5 votes
1 answer
6k views

How does UNC path hardening and SMB signing work under the hood?

With a lot of unpatched versions of Windows in an Active Directory domain, one can man-in-the-middle a client when it connects to the domain controller and inject a group policy that gives an attacker ...
Volker's user avatar
  • 1,253
5 votes
2 answers
3k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
makerofthings7's user avatar
5 votes
2 answers
2k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
RailOcelot's user avatar
5 votes
2 answers
8k views

How does a client authenticate the domain controller

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller? PS: I'm having a problem getting info on how ...
Keith Loughnane's user avatar
5 votes
3 answers
617 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
makerofthings7's user avatar
5 votes
2 answers
2k views

Risk to Domain members in a Domain that's extended into the DMZ

I am an AD administrator trying to look at things from an application server owner's perspective. Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. ...
idarryl's user avatar
  • 123
5 votes
1 answer
3k views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
MartinDotNet's user avatar
5 votes
1 answer
378 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql database....
securityishard's user avatar
5 votes
1 answer
265 views

DSquery leaking personal information

Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs. Firstly, is this considered ...
jia chen's user avatar
  • 149
5 votes
1 answer
3k views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
Karthik's user avatar
  • 153
5 votes
1 answer
360 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
Sahar's user avatar
  • 59
4 votes
1 answer
1k views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
Robert Mennell's user avatar
4 votes
2 answers
4k views

How to locate a domain controller on a Windows network when not a member?

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind. I've ...
Joseph Midas's user avatar
4 votes
2 answers
839 views

Lateral Movement: What is the benefit of Windows Hello For Business?

I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up ...
Robert R's user avatar
4 votes
1 answer
503 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
blsub6's user avatar
  • 141
4 votes
4 answers
514 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
Chri3's user avatar
  • 327
4 votes
1 answer
387 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
Caglar's user avatar
  • 53
4 votes
1 answer
13k views

Where does Active Directory store user hashes?

During a penetration test for a client, having an infrastructure with multiple (5) Active Directory Servers (Win Serv 2008 R2)... I found a nice exploit to drop a system shell in one of the servers, ...
AnonZed's user avatar
  • 61
4 votes
1 answer
631 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
Al Longley's user avatar

1
2 3 4 5 6