5
votes
How does msnbot keep finding my unpublished admin url?
Whilst it's not possible to know definitively, based on the comment from @amon and your response one way which an attacker could find your admin URL would be to use Certificate Transparency Logs.
...
- 62.6k
4
votes
Is there a more secure way for users to log into the domain other than just passwords?
The EAP-TLS authentication mechanism deployment as described only proves that an authorised user is operating the device. This could be a certificate in the local user's profile, the computer's ...
- 587
3
votes
Can (or should) a system admin test a login before sending login info to users?
This is wrong. A sysadmin should never log in or even know the users password in the first place.
The issue is with the system, fix it. A good pitch to the management to get $$ for the fix is to say ...
- 1,022
3
votes
Accepted
Is there a more secure way for users to log into the domain other than just passwords?
Block domain admin login from interactively logging into regular user workstations. You can do this with Group Policy.
Restrict admin connections to trusted admin hosts. The firewall on your ...
- 538
3
votes
Securing a process from local users
As long as the user is not a local administrator on the machine they should not have permission to kill any processes run as other users (including domain administrators).
However unless you have an ...
- 11k
2
votes
Accepted
Implications of joining the active directory domain with the domain administrator
Short answer: No there's no security implication.
You can use a domain admin account or an account with enough delegation to create machine account.
This account will be used to login to the domain ...
- 528
2
votes
Will enforcing this restriction on Domain Admins "break the network"?
The ESAE (Red) Forest is now the goto recommendation for securing Active Directory. https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/securing-privileged-...
2
votes
Securing a process from local users
Barring any exploits, there are two different scenarios here.
If the process is owned by a different user account (e.g. it's owned by the local system account):
One needs to be a member of the local ...
- 247
2
votes
Accepted
Opening PowerShell (PS) session with Service Tickets (STs)
If you follow the example on THM, in the previous step you obtained a ticket to the HTTP service and the WSMAN service in .kirbi format and used mimikatz::ptt on these. If you use the command klist ...
- 531
1
vote
Is Kerberos Constrained Delegation (KCD) deprecated?
To answer the question more directly: No, the original Constrained Delegation is not deprecated. Deprecations are announced early on Microsoft Docs, and you can see things like NTLM up there.
Windows ...
- 291
1
vote
Accepted
Is Kerberos Constrained Delegation (KCD) deprecated?
In Unconstrained Delegation (not mentioned in your article but required knowledge for context) the server that has UC enabled will obtain a TGT from the Domain Controller (I will call it Domain ...
- 531
1
vote
Domain admin can monitor all keystrokes. How can I prove that my computer is being targeted?
If he is domain admin, he can run anything he wants on any computer he wants. He has the power to do that.
And yes, he can check what you have on your computer without needing your password, as long ...
- 55.5k
1
vote
Can (or should) a system admin test a login before sending login info to users?
I'm not seeing the risk in this process. You test all accounts that have been created by this process, and either:
Truely new accounts successfully log in, and the only thing exposed is the data ...
- 132k
1
vote
My boss installs software using domain admin. Should I show that this is bad?
Using domain admin in the current days is like totally ignoring the network security and opening up the gates to the attackers! With tons of security breaches being announced everyday, Active ...
- 141
1
vote
Are non-personal AD users a security risk?
What they should be asking is - How are generic accounts managed and do you know what they are for? The amount is irrelevant if passwords and interactive login are managed.
- 11
Only top scored, non community-wiki answers of a minimum length are eligible