8
votes
Accepted
Any legitimate reason for notepad.exe to make network connections
When a shell dialog (file open/save, print, etc.) is opened, network traffic generated by accesses to SMB file shares or other network resources will be attributed to the process that is accessing ...
- 136k
6
votes
Accepted
Lateral Movement: What is the benefit of Windows Hello For Business?
Disclosure: I work on the team that builds WHfB.
Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this ...
- 15.4k
6
votes
How do companies authenticate internal users in internal systems?
You generally trust your internal applications that you allow to authenticate against an internal user directory. If you don't trust them, it does not make sense to allow then on premises, and ...
- 17.5k
5
votes
How does UNC path hardening and SMB signing work under the hood?
UNC Path Hardening comes from the JASBUG vulnerabilities (MS15-011 and MS15-014).
Microsoft suggests implementing workarounds to the SMB MITM issues easily found in the Responder.py or related tools ...
- 19.1k
5
votes
Accepted
Recover the password of a Windows service user login account
One method to access LSA secrets is documented here.
In a nutshell:
Call the Enable-TSDuplicateToken function.
Copy the existing registry keys to another, temporary key.
User Powershell or another ...
- 9,717
5
votes
How to limit Administrators by day of the week
I would characterise the situation (as stated) as: "The dam has burst and the city is flooded with 3 feet of water. Where can I buy mops?" You appear to have a much, much bigger problem on your hands ...
- 132k
4
votes
What is the difference between a RADIUS server and Active Directory?
I think all of the above answers fail to address the crux of your question, so I'm adding more. The other answers do fit more in line with the InfoSec aspect of RADIUS, but I'm going to give you the ...
- 170
4
votes
Extract Password Hashes from Active Directory LDAP
So, this whole reasoning is kind of insane. Auditing password correctness after the fact is a bad idea (because you either need the original password, or a weak hash that can effectively be rainbow-...
- 15.4k
4
votes
Does Windows really still use unsalted MD4 for password storage?
Yes, Windows domain controllers still store unsalted MD4 password hashes, to enable legacy NTLM authentication and Kerberos authentication with the legacy rc4-hmac-md5 cipher.
By default, Windows also ...
- 587
4
votes
MS Active Directory vs OpenId Connect?
The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences:
Clients ...
- 59.3k
4
votes
Accepted
How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?
A service ticket is a very specific thing. Active Directory will only let you request service tickets to principals that have SPNs registered because otherwise it's not a service principal as far as ...
- 15.4k
3
votes
Accepted
AD-DS: Why Hide the last logged on user?
If you have no credentials or physical access, getting valid user IDs (for example at the logon screen through an RDP session) is a step forward in gaining access to the machine. Some of the users ...
- 589
3
votes
Accepted
Responder mitigation
Can this be mitigated by requiring SMB signing by clients on the
network? i.e. Would this prevent the client from sending its response
to the authentication challenge because the authentication ...
- 34.4k
3
votes
Accepted
Importing bcrypt passwords into Active Directory
AD only uses LM and NTLM password hashes for domain authentication. You won't be able to import the bcrypt hashes and have them work to authenticate users to the domain.
You could modify your web ...
- 8,466
3
votes
External vendor has requested to join our Active Directory Domain
So.. these computers are off your network, in their space, accessing your AD? How are you establishing that? Are you doing a site-site VPN? Most importantly: why? What benefit do you both hope to ...
- 2,788
3
votes
What kind of attacks are mitigated by 2FA/MFA in Industry sector?
In our case, it was the human factor. You're lucky if the post-it with the password doesn't go right on the console. If it doesn't, everyone has the same password that everyone knows.
Staff gets ...
- 2,770
3
votes
How to limit Administrators by day of the week
You're trying to fix a problem that is very, very clearly a human one with naive technology. Someone who does "whacky things" on a day where they are not on-duty as admin cannot simply be trusted ...
- 6,284
3
votes
Windows Servers in DMZ - managed via AD or standalone?
Your reasoning is exactly right.
Your DMZ servers being joined to your internal domain is a risk that should be avoided. Usually a separated Active Directory domain for your DMZ, or running each ...
- 421
3
votes
What is the security concerns of AzureAD?
Azure AD is SaaS so Microsoft is responsible for scanning and securing the infrastructure. It’s important to understand the division of responsibility between you and Microsoft. On-premises, you own ...
3
votes
What is the logic behind Microsoft recommending that creation of "god group" / Tier -0 in their Red Forest model for AD?
Tier 0 is where the crown jewels are kept. Specifically, forest and domain administration privileges. If you isolate those activities and accounts that have that level of access to Tier 0, you can ...
- 36k
3
votes
Accepted
Active Directory Pentesting Methodologies
In most scenarios, Windows Server Forest targets, are hardened quite well, but usually because of the existence of an EDR and/or NIPS that prevents initial entry access.
The whole concept of Active ...
- 19.1k
3
votes
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
The reason why recommendations for years is to stop passwords from expiring is to prevent people from doing what they normally do: mypasswordJune.
If you know that a large section of the user ...
- 132k
3
votes
Accepted
Is there really any benefit in having a separate local admin account
There are several benefits to managing administrative accounts separately from regular user accounts.
Ordinary user activity, like email or web browsing, is done without special admin privileges, ...
- 34.7k
2
votes
Extract Password Hashes from Active Directory LDAP
To pull the passwords remotely, the best solution is to use DC SYNC (DRSUAPI) techniques. Domain controllers use this protocol to sync their information back and forth. If you have Domain ...
- 638
2
votes
Accepted
Is a Kerberos ticket valid with only one-way external trust between domains?
from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to ...
- 731
2
votes
Linux authenticating against Active Directory, is one keytab for all Linux machines enough?
The main point of Kerberos is authentication - it allows networked entities to prove their identity. In order for this to work, each entity needs to have a unique name (in Kerberos jargon, "principal ...
- 131
2
votes
forwarding company email to a contractor's email address
We prohibit the automated forwarding of corporate email to external email accounts as part of our Acceptable Use policy. This policy applies to staff, contractors and any other third parties who have ...
- 21
2
votes
forwarding company email to a contractor's email address
Not certain about blocking login but I think you can - I'm fairly sure there is a setting in AD that blocks login but whether that has other impacts, I don't know.
In regard to data sharing...
You ...
- 7,152
2
votes
userWorkstations attribute in AD preventing users from logging into WebApp
If you add a domain controller in the list of Logon Workstations for a user account, you are saying that the specific account is not restricted, from the account level, from logging onto that DC. ...
- 29
2
votes
Accepted
Active directory based permissions SID, username or email?
Your question is a bit unclear, but it sounds like you want to grant permissions in your app using AD properties associated with an account the user authenticates with. If that's correct, you should ...
- 8,466
Only top scored, non community-wiki answers of a minimum length are eligible