Archives: Active Directory

Dumping the contents of ntds.dit files using PowerShell

October 20, 2015 | Michael Grafnetter | 73 Comments

Although there exist several tools for dumping password hashes from the Active Directory database files, including the open-source NTDSXtract from Csaba Bárta whose great research started it all, they have these limitations: They do not support the built-in indices, so searching for a single object is slow when dealing with large databases. Most of the tools are either Linux-only or running them on Windows is not simple enough. Almost none of these tools can • Read More »

Tags: Active Directory, PowerShell, Security

How Azure Active Directory Connect Syncs Passwords

October 18, 2015 | Michael Grafnetter | 11 Comments

Many people have asked me about the security implications of synchronizing passwords from Active Directory to Azure Active Directory using the Azure AD Connect tool. Although there is an article on Technet that claims that the passwords are synced in a very secure hashed form that cannot be misused for authentication against the on-premise Active Directory, it lacks any detail about the exact information being sent to Microsoft’s servers. A post at • Read More »

Tags: Active Directory, Microsoft Azure, Office 365, PowerShell, Security

Detecting Weak Active Directory Passwords

October 3, 2015 | Michael Grafnetter | No Comments

There is a new tool available for auditing Active Directory passwords, the Get-bADPasswords cmdlet. It has been created by Jakob Heidelberg and it is built upon the features of the DSInternals module.

Tags: Active Directory, PowerShell, Security

List of Cmdlets in the DSInternals Module

September 29, 2015 | Michael Grafnetter | 14 Comments

Here is the list of cmdlets currently contained in the DSInternals PowerShell module: Online operations with the Active Directory database Get-ADReplAccount – Reads one or more accounts through the DRSR protocol, including secret attributes. Set-SamAccountPasswordHash – Sets NT and LM hashes of an account through the SAMR protocol. Get-ADReplBackupKey – Reads the DPAPI backup keys through the DRSR protocol. Offline operations with the Active Directory database Get-ADDBAccount – • Read More »

Tags: Active Directory, DPAPI, Microsoft Azure, Office 365, PowerShell, Security

Peeking into the Active Directory Database

September 28, 2015 | Michael Grafnetter | No Comments

During my recent talk about inner workings of Active Directory, I showcased the Esent Workbench tool, which can be used to look inside a ntds.dit file. But one must really have stomach for it.

Tags: Active Directory

New version of the DSInternals module released

September 5, 2015 | Michael Grafnetter | No Comments

I have released a new version of the DSInternals PowerShell module. This is mainly a bugfix release. You can grab it from the Downloads section. Or, if you have PowerShell 5, you can install the module from the PowerShell Gallery by running this command:

1	Install-Module -Name DSInternals

Tags: Active Directory, Microsoft Azure, PowerShell, Security

Retrieving Active Directory Passwords Remotely

August 4, 2015 | Michael Grafnetter | 114 Comments

I have finally finished work on the Get-ADReplAccount cmdlet, the newest addition to my DSInternals PowerShell Module, that can retrieve reversibly encrypted plaintext passwords, password hashes and Kerberos keys of all user accounts from remote domain controllers. This is achieved by simulating the behavior of the dcromo tool and creating a replica of Active Directory database through the MS-DRSR protocol. Furthermore, it has these properties: It does not even need the Domain Admins group membership. • Read More »

Tags: Active Directory, PowerShell, Security

The DSInternals PowerShell Module has been released

February 28, 2015 | Michael Grafnetter | 2 Comments

I have decided to publish the DSInternals PowerShell Module, which contains a few cmdlets I use during my lectures about Active Directory security. You can find it in the Downloads section. It currently lacks any documentation, so Get-Help won’t give you nice results, but I am working on that. Examples

Import-Module DSInternals

$pwd = ConvertTo-SecureString 'Pa$$W0rd' -AsPlainText -Force

# Calculate the NT and LM hashes

ConvertTo-NTHash $pwd

# Output: 92937945b518814341de3f726500d4ff

ConvertTo-LMHash $pwd

# Output: 727e3576618fa1754a3b108f3fa6cb6d

# Set AD account password hash using the SAMR protocol

Set-SamAccountPasswordHash -SamAccountName john -Domain ADATUM -NTHash '92937945b518814341de3f726500d4ff' -Server dc1.adatum.com

# Calculate the OrgId hash, that is sent to Azure Active Directory by DirSync

ConvertTo-OrgIdHash -NTHash '92937945b518814341de3f726500d4ff'

# Output: v1;PPH1_MD4,f76bc776428002f87f4b,100,0ab46c4a6351db87cc13323bb01eea073c90a52e376fffca559e57fbb19a441a;

# Decrypt a password from Group Policy Preferences

ConvertFrom-GPPrefPassword 'v9NWtCCOKEUHkZBxakMd6HLzo4+DzuizXP83EaImqF8'

# Output: Pa$$w0rd

# Decrypt a password from an unattend.xml file

ConvertFrom-UnattendXmlPassword 'UABhACQAJAB3ADAAcgBkAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA=='

# Output: Pa$$w0rd

Error reporting If you find an error in the DSInternals Powershell Module, I would be glad if you sent me an e-mail. Planned • Read More »

Tags: Active Directory, Microsoft Azure, PowerShell