Skip to main content
45 votes
Accepted

Why do I need Kerberos when I could just use a username and password to access services?

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine ...
Luis Casillas's user avatar
36 votes
Accepted

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? RADIUS is an older, simple authentication mechanism which was designed to allow network devices (...
gowenfawr's user avatar
  • 72.9k
27 votes

Why do I need Kerberos when I could just use a username and password to access services?

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's ...
DKNUCKLES's user avatar
  • 9,217
19 votes

Extract Password Hashes from Active Directory LDAP

You do not need to process the .dit file to acquire hashes from AD or AD LDS; you can access the stored password hashes programmatically. Normal attempts to read a user's userpassword attribute is ...
Alex's user avatar
  • 191
12 votes

Why do I need Kerberos when I could just use a username and password to access services?

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes ...
duffbeer703's user avatar
12 votes

What is the difference between a RADIUS server and Active Directory?

All the comments and answers boiled down the RADIUS protocol to simple authentication. But RADIUS is a triple A protocol = AAA: authentication, authorization and accounting. RADIUS is a very ...
cornelinux's user avatar
  • 2,063
8 votes

Why do I need Kerberos when I could just use a username and password to access services?

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of ...
paj28's user avatar
  • 33.5k
7 votes
Accepted

Any legitimate reason for notepad.exe to make network connections

When a shell dialog (file open/save, print, etc.) is opened, network traffic generated by accesses to SMB file shares or other network resources will be attributed to the process that is accessing ...
Polynomial's user avatar
  • 135k
6 votes
Accepted

Lateral Movement: What is the benefit of Windows Hello For Business?

Disclosure: I work on the team that builds WHfB. Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this ...
Steve's user avatar
  • 15.3k
6 votes

How do companies authenticate internal users in internal systems?

You generally trust your internal applications that you allow to authenticate against an internal user directory. If you don't trust them, it does not make sense to allow then on premises, and ...
vidarlo's user avatar
  • 16.6k
5 votes

How does UNC path hardening and SMB signing work under the hood?

UNC Path Hardening comes from the JASBUG vulnerabilities (MS15-011 and MS15-014). Microsoft suggests implementing workarounds to the SMB MITM issues easily found in the Responder.py or related tools ...
atdre's user avatar
  • 19.1k
5 votes
Accepted

Recover the password of a Windows service user login account

One method to access LSA secrets is documented here. In a nutshell: Call the Enable-TSDuplicateToken function. Copy the existing registry keys to another, temporary key. User Powershell or another ...
Royce Williams's user avatar
5 votes

How to limit Administrators by day of the week

I would characterise the situation (as stated) as: "The dam has burst and the city is flooded with 3 feet of water. Where can I buy mops?" You appear to have a much, much bigger problem on your hands ...
schroeder's user avatar
  • 131k
4 votes

What is the difference between a RADIUS server and Active Directory?

I think all of the above answers fail to address the crux of your question, so I'm adding more. The other answers do fit more in line with the InfoSec aspect of RADIUS, but I'm going to give you the ...
Thomas's user avatar
  • 170
4 votes

Extract Password Hashes from Active Directory LDAP

So, this whole reasoning is kind of insane. Auditing password correctness after the fact is a bad idea (because you either need the original password, or a weak hash that can effectively be rainbow-...
Steve's user avatar
  • 15.3k
4 votes

Does Windows really still use unsalted MD4 for password storage?

Yes, Windows domain controllers still store unsalted MD4 password hashes, to enable legacy NTLM authentication and Kerberos authentication with the legacy rc4-hmac-md5 cipher. By default, Windows also ...
AardvarkSoup's user avatar
4 votes

Compromised server name and port number of a SQL Server DB Server

Sounds to me, that what was leaked is only information obtainable by a simple nmap scan. If the security of your system depended on that staying private, you might have an issue in you approach ...
daniel f.'s user avatar
  • 281
4 votes

MS Active Directory vs OpenId Connect?

The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences: Clients ...
Mike Ounsworth's user avatar
4 votes
Accepted

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

A service ticket is a very specific thing. Active Directory will only let you request service tickets to principals that have SPNs registered because otherwise it's not a service principal as far as ...
Steve's user avatar
  • 15.3k
3 votes

Compromised server name and port number of a SQL Server DB Server

Because this is an internal server, the potential here is that you have leaked some information about how your organization configures internal DNS and SQL servers. This is not a danger to this ...
schroeder's user avatar
  • 131k
3 votes
Accepted

Active Directory Admin policy

You will have to weigh decisionmaker risk tolerance against your overall business loss exceedance, typically both on curves of the same graph. What is at risk (tell the CFO and CEO that what's at ...
atdre's user avatar
  • 19.1k
3 votes
Accepted

Importing bcrypt passwords into Active Directory

AD only uses LM and NTLM password hashes for domain authentication. You won't be able to import the bcrypt hashes and have them work to authenticate users to the domain. You could modify your web ...
PwdRsch's user avatar
  • 8,446
3 votes
Accepted

Responder mitigation

Can this be mitigated by requiring SMB signing by clients on the network? i.e. Would this prevent the client from sending its response to the authentication challenge because the authentication ...
SilverlightFox's user avatar
3 votes
Accepted

AD-DS: Why Hide the last logged on user?

If you have no credentials or physical access, getting valid user IDs (for example at the logon screen through an RDP session) is a step forward in gaining access to the machine. Some of the users ...
knipp's user avatar
  • 589
3 votes

External vendor has requested to join our Active Directory Domain

So.. these computers are off your network, in their space, accessing your AD? How are you establishing that? Are you doing a site-site VPN? Most importantly: why? What benefit do you both hope to ...
baldPrussian's user avatar
  • 2,778
3 votes

What kind of attacks are mitigated by 2FA/MFA in Industry sector?

In our case, it was the human factor. You're lucky if the post-it with the password doesn't go right on the console. If it doesn't, everyone has the same password that everyone knows. Staff gets ...
Therac's user avatar
  • 2,680
3 votes

How to limit Administrators by day of the week

You're trying to fix a problem that is very, very clearly a human one with naive technology. Someone who does "whacky things" on a day where they are not on-duty as admin cannot simply be trusted ...
Marcus Müller's user avatar
3 votes

Windows Servers in DMZ - managed via AD or standalone?

Your reasoning is exactly right. Your DMZ servers being joined to your internal domain is a risk that should be avoided. Usually a separated Active Directory domain for your DMZ, or running each ...
Stephen Sennett's user avatar
3 votes

What is the security concerns of AzureAD?

Azure AD is SaaS so Microsoft is responsible for scanning and securing the infrastructure. It’s important to understand the division of responsibility between you and Microsoft. On-premises, you own ...
Ken W - Zero Networks's user avatar
3 votes

What is the logic behind Microsoft recommending that creation of "god group" / Tier -0 in their Red Forest model for AD?

Tier 0 is where the crown jewels are kept. Specifically, forest and domain administration privileges. If you isolate those activities and accounts that have that level of access to Tier 0, you can ...
Xander's user avatar
  • 35.8k

Only top scored, non community-wiki answers of a minimum length are eligible