Here is the recording of my Black Hat Europe 2019 Briefings session about Exploiting Windows Hello for Business:
Tags: Active Directory, PowerShell, Security, Video
Here is the recording of my Black Hat Europe 2019 Briefings session about Exploiting Windows Hello for Business:
Tags: Active Directory, PowerShell, Security, Video
Briefings: Exploiting Windows Hello for Business Arsenal: DSInternals PowerShell Module
Tags: Active Directory, PowerShell, Security
Tags: Active Directory, PowerShell, Security, SID History, Video
Introduction Last month, Microsoft has introduced a new feature of Azure AD Connect called Single Sign On. It allows companies to configure SSO between AD and AAD without the need to deploy ADFS, which makes it an ideal solution for SMEs. Here is a high-level diagram of this functionality: As we can see from the diagram above, Azure AD exposes a publicly available endpoint that accepts Kerberos tickets and translates them • Read More »
Tags: Active Directory, Microsoft Azure, Mimikatz, Office 365, Security
Overview The latest version of the DSInternals PowerShell Module contains a new cmdlet called Test-PasswordQuality, which is a powerful yet easy to use tool for Active Directory password auditing. It can detect weak, duplicate, default, non-expiring or empty passwords and find accounts that are violating security best practices. All domain administrators can now audit Active Directory passwords on a regular basis, without any special knowledge. Usage The Test-PasswordQuality cmdlet • Read More »
Tags: Active Directory, PowerShell, Security
Since version 2.15, the DSInternals PowerShell Module fully supports Windows PE, the free minimalistic edition of Windows. This means that all the nasty Active Directory database stuff can now be performed from a bootable flash drive or an ISO image, including: Dumping NT hashes, kerberos keys and cleartext passwords from ntds.dit files. Modifying the SID History of user accounts and groups. Modifying the Primary Group ID of user accounts. Extracting the DPAPI domain • Read More »
Tags: Active Directory, DPAPI, PowerShell, Security
One of the new features in Windows Server 2016 will be the Active Directory Expiring Links feature, which enables time-bound group membership, expressed by a time-to-live (TTL) value. Here is how it works: Enabling the Expiring Links Feature The Expiring Links feature had been a standalone feature in early Windows Server 2016 builds, but as of TP4, it is a part of the broader Privileged Access Management (PAM) feature. It • Read More »
Tags: Active Directory, LDAP, PowerShell, Security
I am happy to announce that a new version of the DSInternals PowerShell Module has been released, now with Windows Server 2003 support.
Tags: Active Directory, PowerShell, Security
Have you ever wondered how the automatically generated passwords of Group Managed Service Accounts (GMSA) look like? Well, you can fetch them from Active Directory in the same way as Windows Servers do and see yourself. Here is how: Creating a GMSA To start experimenting, we need to have a GMSA first, so we create one:
1 2 3 4 5 6 7 |
# Create a new KDS Root Key that will be used by DC to generate managed passwords Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10) # Create a new GMSA New-ADServiceAccount ` -Name 'SQL_HQ_Primary' ` -DNSHostName 'sql1.adatum.com' |
We can check the result in the Active Directory Users and Computers console: Unfortunately, the built-in GUI • Read More »
Tags: Active Directory, LDAP, PowerShell, Security
Introduction The Data Protection API (DPAPI) is used by several components of Windows to securely store passwords, encryption keys and other sensitive data. When DPAPI is used in an Active Directory domain environment, a copy of user’s master key is encrypted with a so-called DPAPI Domain Backup Key that is known to all domain controllers. Windows Server 2000 DCs use a symmetric key and newer systems use a public/private key pair. If the user password is reset • Read More »
Tags: Active Directory, DPAPI, PowerShell, Security