44
votes
Accepted
Why do I need Kerberos when I could just use a username and password to access services?
Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access?
Imagine ...
- 10.4k
36
votes
Accepted
What is the difference between a RADIUS server and Active Directory?
Why would I need a RADIUS server if my clients can connect and
authenticate with Active Directory?
RADIUS is an older, simple authentication mechanism which was designed to allow network devices (...
- 72.5k
27
votes
Why do I need Kerberos when I could just use a username and password to access services?
Simply put, that would be an administrative nightmare.
Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain.
Let's ...
- 9,237
17
votes
Extract Password Hashes from Active Directory LDAP
You do not need to process the DIT file to aquire hashes from AD or AD LDS, there is some protocol access as well.
Even though a regular LDAP-reads on "userpassword" Attribute (as you can do on other ...
- 171
12
votes
What is the difference between a RADIUS server and Active Directory?
All the comments and answers boiled down the RADIUS protocol to simple authentication. But RADIUS is a triple A protocol = AAA: authentication, authorization and accounting.
RADIUS is a very ...
- 2,023
12
votes
Why do I need Kerberos when I could just use a username and password to access services?
Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit.
A great explanation is Designing an Authentication System: A Dialog in Four Scenes
...
- 433
9
votes
Accepted
AD User vs SQL User for SQL Server Authentication
Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL ...
- 35.7k
8
votes
Why do I need Kerberos when I could just use a username and password to access services?
To prevent lateral escalation.
The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of ...
- 33k
7
votes
Accepted
Setting up a honeypot to detect malicious network activity
It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the ...
- 2,289
7
votes
Accepted
Any legitimate reason for notepad.exe to make network connections
When a shell dialog (file open/save, print, etc.) is opened, network traffic generated by accesses to SMB file shares or other network resources will be attributed to the process that is accessing ...
- 134k
6
votes
Accepted
Extract Password Hashes from Active Directory LDAP
You need to get the NTDS.DIT binary file out of %SystemRoot%\ntds.
You can use ntdsutil to create a snapshot of the AD database so that you can copy NTDS.DIT.
Then you can use something like the ...
- 423
6
votes
Accepted
Lateral Movement: What is the benefit of Windows Hello For Business?
Disclosure: I work on the team that builds WHfB.
Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this ...
- 15.2k
6
votes
How do companies authenticate internal users in internal systems?
You generally trust your internal applications that you allow to authenticate against an internal user directory. If you don't trust them, it does not make sense to allow then on premises, and ...
- 15.2k
5
votes
Accessing user accounts without asking for their password
Firstly as per @EricG most of the administration should be handled using a network administrator account, using group policies and the like.
If you need access to a users logged-in session the best ...
- 2,802
5
votes
How does UNC path hardening and SMB signing work under the hood?
UNC Path Hardening comes from the JASBUG vulnerabilities (MS15-011 and MS15-014).
Microsoft suggests implementing workarounds to the SMB MITM issues easily found in the Responder.py or related tools ...
- 19k
5
votes
Accepted
Recover the password of a Windows service user login account
One method to access LSA secrets is documented here.
In a nutshell:
Call the Enable-TSDuplicateToken function.
Copy the existing registry keys to another, temporary key.
User Powershell or another ...
- 9,358
5
votes
How to limit Administrators by day of the week
I would characterise the situation (as stated) as: "The dam has burst and the city is flooded with 3 feet of water. Where can I buy mops?" You appear to have a much, much bigger problem on your hands ...
- 127k
4
votes
AD User vs SQL User for SQL Server Authentication
Using Active Directory for SQL Server has a number of advantages, which makes it the recommended approach. SQL DBAs will often want to have the database in Windows Integrated Authentication (WIA) mode ...
4
votes
How does resetting passwords twice increase security after a breach?
If an OS effectively remembers the current password and also the previous password to force a true password reset, you will need to change the password twice to flush the old password hashes from the ...
- 1,557
4
votes
Extract Password Hashes from Active Directory LDAP
So, this whole reasoning is kind of insane. Auditing password correctness after the fact is a bad idea (because you either need the original password, or a weak hash that can effectively be rainbow-...
- 15.2k
4
votes
Accepted
What are the real risks of enabling unsecure DNS updates on Active Directory intranet domain?
When you use secure dynamic updates only the domain members can update their entries. This is achieved by using kerberos to authentificate the client towards the DNS-Server. This authentification ...
- 4,303
4
votes
What is the difference between a RADIUS server and Active Directory?
I think all of the above answers fail to address the crux of your question, so I'm adding more. The other answers do fit more in line with the InfoSec aspect of RADIUS, but I'm going to give you the ...
- 170
4
votes
Compromised server name and port number of a SQL Server DB Server
Sounds to me, that what was leaked is only information obtainable by a simple nmap scan.
If the security of your system depended on that staying private, you might have an issue in you approach ...
- 281
4
votes
MS Active Directory vs OpenId Connect?
The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences:
Clients ...
- 58.3k
3
votes
Accepted
Active Directory password complexity based onto entropy
Yes. You would need to create a custom Password Filter, but it's not a point and click function. See this Microsoft article on how to do so: Custom Password Filter
There are also a number of third ...
- 74
3
votes
Does Windows really still use unsalted MD4 for password storage?
Yes, Windows domain controllers still store unsalted MD4 password hashes, to enable legacy NTLM authentication and Kerberos authentication with the legacy rc4-hmac-md5 cipher.
By default, Windows also ...
- 577
3
votes
password strength audits and mitigations
Yes, regularly. For many of my clients we create policies that require at least annual audits of passwords across all devices, including Windows AD, that tests accounts against the top 500 most ...
- 1,834
3
votes
How can I determine the domain controller when it's not in DNS?
Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since ...
3
votes
Limiting Concurrent Login For System Admins On Windows Domain
so I don't think this is going to be 100% possible.
What you can do is limit your servers to a single RDP session :
https://support.managed.com/kb/a1816/how-to-enable-disable-multiple-rdp-sessions-...
- 131
3
votes
Monitoring Active Directory Domain Administrator Activities
I think you should consider filtering and aggregating the Windows event logs. You can start by filtering for specific events, like 4624, successful logon of a user: https://www.ultimatewindowssecurity....
- 241
Only top scored, non community-wiki answers of a minimum length are eligible