68

If you have access, check the Security Event logs: eventvwr.msc . Look for failed logon events and you will see your password as an unknown user account if the logging is set up to record those kinds of events. EDIT I just tested this on Win7 SP1. It requires that Failure Auditing is enabled. I tried to log in with a bogus username, and this was the ...


41

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


30

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? RADIUS is an older, simple authentication mechanism which was designed to allow network devices (think: routers, VPN concentrators, switches doing Network Access Control (NAC)) to authenticate users. It doesn't have any sort of complex membership ...


27

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-enter ...


17

The question is a bit hard for me to decipher, but I am going to assume you are considering authenticating users by having the user present a username and password, and also having the user authenticate with a private key (client cert) that is stored on the user's device. Short answer: yes, this is generally beneficial. If the user authenticates by both a ...


13

You do not need to process the DIT file to aquire hashes from AD or AD LDS, there is some protocol access as well. Even though a regular LDAP-reads on "userpassword" Attribute (as you can do on other directory products) will always be blocked completely in AD, there is another official way to read hashes from AD or AD LDS and its officially been there since ...


12

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


12

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


10

ARP poisoning and IP spoofing are one way to do this with nothing more than a node on the network. In general, what you end up doing is impersonating the AD server during negotiation. The technical details probably aren't interesting in this context, but if you pretend to be the AD server, you can do a lot of things. One of these things might be to ...


10

All the comments and answers boiled down the RADIUS protocol to simple authentication. But RADIUS is a triple A protocol = AAA: authentication, authorization and accounting. RADIUS is a very extensable protocol. It works with key value pairs and you can define new ones on your own. Most common scenario is, that the RADIUS server returns authorization ...


8

Having done the same mistake myself a couple of years ago: Most protocols/software will return an error code if you try to login with a valid username (other than "anonymous") and an empty password. That is even true for most systems that allow some kind of anonymous usage without being logged in at all. For LDAP, however, the common case is that the ...


8

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


8

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform. SQL Authentication is a legacy authentication mechanism that in a properly ...


7

The answer is simple: do not allow Domain Admins. Give access to specific functions to specific people who are in the job of administration. The "Domain Admin" group should be empty with alerts when a user is added to this group. In small teams, this might be a little tricky, but you can include people outside of the IT admin staff for oversight, and you ...


7

I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin ...


7

Assuming that the LDAPS server does not have security holes, exposing it to the wide Internet should be no more risky (and no less) than exposing a HTTPS Web server. With LDAPS (SSL outside, traditionally on port 636, LDAP protocol in it), the authentication requested by the server will be performed under the protection of SSL, so that's fine (provided that ...


7

Several cloud vendors require LDAP access to AD in order to authenticate users... I can name 10 off the top of my head; so it's not uncommon in a limited scope. I would say it is unwise to open up LDAP to the broad internet (no IP filter) without additional controls (VPN, authentication,etc) Since you're exposing your LDAP server to additional load, I ...


7

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


6

You need to get the NTDS.DIT binary file out of %SystemRoot%\ntds. You can use ntdsutil to create a snapshot of the AD database so that you can copy NTDS.DIT. Then you can use something like the Windows Password Recovery tool to extract the hashes. https://technet.microsoft.com/en-us/library/cc753343.aspx https://technet.microsoft.com/en-us/library/...


6

It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself). If you are using full interaction honeypots, like a real Windows machine, that the chances are high ...


5

I'm not sure your security expectations here are realistic. If someone gets access to your DC in such a way that allows them to change arbitrary account passwords, then you've got plenty of bigger problems to worry about. If they could re-boot the system in order to force their password change to take effect (after which point, your hypothetical additional ...


5

I would not say it is common to expose LDAP services to the internett. What business case do you have to do this? Is is much like you do not want to expose your database server to the Internett. It is usually access only via. DMZ services, while your LDAP rests on the internal network. If I do Shodan search for port:389 I get no results, compared to MySQL ...


5

Try type "any" or "SRV" Did you query for the "any" DNS resource record (wildcard/pseudo) type? (Otherwise the default is to simple query for A records. And the records in question are in fact SRV RRs.) (Also: you said you used type "all", I don't know if there is such a thing. What any does is translate to a query for resource record type 0x00FF, ...


5

Firstly as per @EricG most of the administration should be handled using a network administrator account, using group policies and the like. If you need access to a users logged-in session the best way to approach this is to have the user login to their machine and then hand you the keyboard. That way you never learn there password, and the user can observe ...


5

UNC Path Hardening comes from the JASBUG vulnerabilities (MS15-011 and MS15-014). Microsoft suggests implementing workarounds to the SMB MITM issues easily found in the Responder.py or related tools and techniques (e.g., CORE Impacket, Potato, Tater, SmashedPotato, et al) which include but are not limited to SMB Signing. More information available via these ...


5

I would characterise the situation (as stated) as: "The dam has burst and the city is flooded with 3 feet of water. Where can I buy mops?" You appear to have a much, much bigger problem on your hands than limiting the access of your admins to certain days. Limit the people who have admins rights to those who have been trained in your company's policies and ...


4

It really depends on the technology you use to implement multifactor auth. If you use smartcards with Active Directory then you need to modify all client devices to support smart cards and configure each user account in AD for certificates. You don't have to modify IIS if you are planning on doing just Windows auth, but if you want mutual auth in IIS with ...


4

Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!) As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol. For ...


4

I'm not sure what OAuth gives you that can't be accomplished using other means. WCF + Rest works very well with claims based authentication bundled in WIF. Since WCF implies you're using ASP.NET I recommend using Windows Identity Foundation (WIF) on the server side. Check out this ebook for more info. Next you need a way to expose AD to your app. You ...


4

In worst case an attacker can run query of his choice in LDAP directory. Results may differ but definitely you don't want attacker to do this. If you are using .NET framework, you could use AntiXSS library. I know that LDAP injection is not XSS, nevertheless XSS is also a form of injection and correct way to prevent this kind of vulnerabilities is to ...


Only top voted, non community-wiki answers of a minimum length are eligible