Search Results

AFAIK the token is never destroyed as the session is still present, but that doesn't mean the token doesn't get stale. The token gets refreshed on an unlock.

Your best option is probably going to be a RODC if you want to be able to have full control over the domain(s). A RODC is not any regular domain controller. By default all authentication requests are …

Disclosure: I work on the team that builds WHfB. Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this pro …

How exactly would that session key be kept in sync between the KDC and the target service? The KDC encrypts the ticket to a key the server knows. That therefore means both the KDC and the target serve …

It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure e …

Specifically it's intended for User accounts that are used as service accounts, instead of using a computer account.

You would have to ban RC4 entirely to be protected. This is possible and it would prevent an attacker from requesting a TGT with an RC4 request. This is a global setting you apply to DCs. One thing to …

RDP uses a protocol called CredSSP to delegate credentials. The process works like this. MSTSC prompts for credentials (or uses saved creds) MSTSC requests a network logon ticket (Kerberos or NTLM) …

No, it's not. The client prompts for the password using a thing called Cred UI, which passes it off the to Windows security stack called LSA. LSA converts the password into a Kerberos key and attempts …

So, this whole reasoning is kind of insane. Auditing password correctness after the fact is a bad idea (because you either need the original password, or a weak hash that can effectively be rainbow-ta …

A service ticket is a very specific thing. Active Directory will only let you request service tickets to principals that have SPNs registered because otherwise it's not a service principal as far as K …

Years ago I worked at a school board of 40,000+ users/staff, and each user had an AD account. There was an Identity Management System in place, so the student records would populate AD. As long as th …

NTLMv1 uses MD4, v2 uses MD5, and the Windows implementation of Kerberos uses a KDF using HMAC-SHA1 for AES 128/256. Active Directory can actually store multiple types of hashes of passwords dependin …

In short: no, unconstrained delegation is not more secure than constrained delegation (that does not necessarily prove the inverse either, but that's a different conversation). You're conflating S4U2 …

What is the motivation for administrators to launch services with SPN from domain user accounts? There are five ways you can set these things up: Local service on a workgroup machine Local user on …