Active Directory Recon Without Admin Rights

<!DOCTYPE html>   <html lang="en-US" prefix="og: http://ogp.me/ns#">  <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Active Directory Recon Without Admin Rights – Active Directory Security</title> <meta name='robots' content='max-image-preview:large' /> <link rel="alternate" type="application/rss+xml" title="Active Directory Security » Feed" href="https://adsecurity.org/?feed=rss2" /> <link rel="alternate" type="application/rss+xml" title="Active Directory Security » Comments Feed" href="https://adsecurity.org/?feed=comments-rss2" /> <script type="text/javascript"> /* <![CDATA[ */ window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/adsecurity.org\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.5"}}; /*! This file is auto-generated */ !function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83d\udc26\u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings); /* ]]> */ </script> <style id='wp-emoji-styles-inline-css' type='text/css'> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='https://adsecurity.org/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5' type='text/css' media='all' /> <style id='classic-theme-styles-inline-css' type='text/css'> /*! This file is auto-generated */ .wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none} </style> <style id='global-styles-inline-css' type='text/css'> body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 14px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 20px;--wp--preset--font-size--x-large: 42px;--wp--preset--font-size--tiny: 10px;--wp--preset--font-size--regular: 16px;--wp--preset--font-size--larger: 26px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body .is-layout-grid{display: grid;}body .is-layout-grid > *{margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} .wp-block-navigation a:where(:not(.wp-element-button)){color: inherit;} :where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;} :where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;} .wp-block-pullquote{font-size: 1.5em;line-height: 1.6;} </style> <link rel='stylesheet' id='bootstrap-css' href='https://adsecurity.org/wp-content/themes/graphene/bootstrap/css/bootstrap.min.css?ver=6.5.5' type='text/css' media='all' /> <link rel='stylesheet' id='font-awesome-css' href='https://adsecurity.org/wp-content/themes/graphene/fonts/font-awesome/css/font-awesome.min.css?ver=6.5.5' type='text/css' media='all' /> <link rel='stylesheet' id='graphene-css' href='https://adsecurity.org/wp-content/themes/graphene/style.css?ver=2.8.4' type='text/css' media='screen' /> <link rel='stylesheet' id='graphene-responsive-css' href='https://adsecurity.org/wp-content/themes/graphene/responsive.css?ver=2.8.4' type='text/css' media='all' /> <link rel='stylesheet' id='graphene-blocks-css' href='https://adsecurity.org/wp-content/themes/graphene/blocks.css?ver=2.8.4' type='text/css' media='all' /> <script type="text/javascript" src="https://adsecurity.org/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script> <script type="text/javascript" src="https://adsecurity.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1" id="jquery-migrate-js"></script> <script defer type="text/javascript" src="https://adsecurity.org/wp-content/themes/graphene/bootstrap/js/bootstrap.min.js?ver=2.8.4" id="bootstrap-js"></script> <script defer type="text/javascript" src="https://adsecurity.org/wp-content/themes/graphene/js/bootstrap-hover-dropdown/bootstrap-hover-dropdown.min.js?ver=2.8.4" id="bootstrap-hover-dropdown-js"></script> <script defer type="text/javascript" src="https://adsecurity.org/wp-content/themes/graphene/js/bootstrap-submenu/bootstrap-submenu.min.js?ver=2.8.4" id="bootstrap-submenu-js"></script> <script defer type="text/javascript" src="https://adsecurity.org/wp-content/themes/graphene/js/jquery.infinitescroll.min.js?ver=2.8.4" id="infinite-scroll-js"></script> <script type="text/javascript" id="graphene-js-extra"> /* <![CDATA[ */ var grapheneJS = {"siteurl":"https:\/\/adsecurity.org","ajaxurl":"https:\/\/adsecurity.org\/wp-admin\/admin-ajax.php","templateUrl":"https:\/\/adsecurity.org\/wp-content\/themes\/graphene","isSingular":"1","enableStickyMenu":"","shouldShowComments":"1","commentsOrder":"newest","sliderDisable":"","sliderInterval":"7000","infScrollBtnLbl":"Load more","infScrollOn":"","infScrollCommentsOn":"","totalPosts":"1","postsPerPage":"10","isPageNavi":"","infScrollMsgText":"Fetching window.grapheneInfScrollItemsPerPage of window.grapheneInfScrollItemsLeft items left ...","infScrollMsgTextPlural":"Fetching window.grapheneInfScrollItemsPerPage of window.grapheneInfScrollItemsLeft items left ...","infScrollFinishedText":"All loaded!","commentsPerPage":"50","totalComments":"0","infScrollCommentsMsg":"Fetching window.grapheneInfScrollCommentsPerPage of window.grapheneInfScrollCommentsLeft comments left ...","infScrollCommentsMsgPlural":"Fetching window.grapheneInfScrollCommentsPerPage of window.grapheneInfScrollCommentsLeft comments left ...","infScrollCommentsFinishedMsg":"All comments loaded!","disableLiveSearch":"1","txtNoResult":"No result found.","isMasonry":""}; /* ]]> */ </script> <script defer type="text/javascript" src="https://adsecurity.org/wp-content/themes/graphene/js/graphene.js?ver=2.8.4" id="graphene-js"></script> <script type="text/javascript" id="wpstg-global-js-extra"> /* <![CDATA[ */ var wpstg = {"nonce":"7d657d8247"}; /* ]]> */ </script> <script type="text/javascript" src="https://adsecurity.org/wp-content/plugins/wp-staging-pro/assets/js/dist/wpstg-blank-loader.min.js?ver=6.5.5" id="wpstg-global-js"></script> <link rel="https://api.w.org/" href="https://adsecurity.org/index.php?rest_route=/" /><link rel="alternate" type="application/json" href="https://adsecurity.org/index.php?rest_route=/wp/v2/posts/2535" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://adsecurity.org/xmlrpc.php?rsd" /> <meta name="generator" content="WordPress 6.5.5" /> <link rel="canonical" href="https://adsecurity.org/?p=2535" /> <link rel='shortlink' href='https://adsecurity.org/?p=2535' /> <link rel="alternate" type="application/json+oembed" href="https://adsecurity.org/index.php?rest_route=%2Foembed%2F1.0%2Fembed&url=https%3A%2F%2Fadsecurity.org%2F%3Fp%3D2535" /> <link rel="alternate" type="text/xml+oembed" href="https://adsecurity.org/index.php?rest_route=%2Foembed%2F1.0%2Fembed&url=https%3A%2F%2Fadsecurity.org%2F%3Fp%3D2535&format=xml" /> <script type="text/javascript"> var _statcounter = _statcounter || []; _statcounter.push({"tags": {"author": "SeanMetcalf"}}); </script> <script> WebFontConfig = { google: { families: ["Lato:400,400i,700,700i&display=swap"] } }; (function(d) { var wf = d.createElement('script'), s = d.scripts[0]; wf.src = 'https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js'; wf.async = true; s.parentNode.insertBefore(wf, s); })(document); </script> <style type="text/css"> .header_title, .header_title a, .header_title a:visited, .header_title a:hover, .header_desc {color:#000000}.carousel, .carousel .item{height:400px}@media (max-width: 991px) {.carousel, .carousel .item{height:250px}}#header{max-height:198px}@media (min-width: 1200px) {.container {width:1280px}} </style> <script type="application/ld+json">{"@context":"http:\/\/schema.org","@type":"Article","mainEntityOfPage":"https:\/\/adsecurity.org\/?p=2535","publisher":{"@type":"Organization","name":"Active Directory Security"},"headline":"Active Directory Recon Without Admin Rights","datePublished":"2016-01-27T15:53:29+00:00","dateModified":"2016-01-27T16:02:43+00:00","description":"A fact that is often forgotten (or misunderstood), is that most objects and their attributes can be viewed (read) by authenticated users (most often, domain users). The challenge is that admins may think that since this data is most easily accessible via admin tools such as \"Active Directory User and Computers\" (dsa.msc) or \"Active Directory ...","author":{"@type":"Person","name":"Sean Metcalf"},"image":["https:\/\/adsecurity.org\/wp-content\/uploads\/2016\/01\/ADS-GetADContacts.jpg"]}</script> <style type="text/css">.recentcomments a{display:inline !important;padding:0 !important;margin:0 !important;}</style><meta property="og:type" content="article" /> <meta property="og:title" content="Active Directory Recon Without Admin Rights" /> <meta property="og:url" content="https://adsecurity.org/?p=2535" /> <meta property="og:site_name" content="Active Directory Security" /> <meta property="og:description" content="A fact that is often forgotten (or misunderstood), is that most objects and their attributes can be viewed (read) by authenticated users (most often, domain users). The challenge is that admins may think that since this data is most easily accessible via admin tools such as "Active Directory User and Computers" (dsa.msc) or "Active Directory ..." /> <meta property="og:updated_time" content="2016-01-27T16:02:43+00:00" /> <meta property="article:modified_time" content="2016-01-27T16:02:43+00:00" /> <meta property="article:published_time" content="2016-01-27T15:53:29+00:00" /> <meta property="og:image" content="https://adsecurity.org/wp-content/uploads/2016/01/ADS-GetADContacts.jpg" /> <meta property="og:image:width" content="503" /> <meta property="og:image:height" content="630" /> </head> <body class="post-template-default single single-post postid-2535 single-format-standard custom-background wp-embed-responsive layout-boxed two_col_left two-columns singular"> <div class="container boxed-wrapper"> <div id="top-bar" class="row clearfix top-bar "> <div class="col-md-12 top-bar-items"> <ul class="social-profiles"> <li class="social-profile social-profile-rss"> <a href="https://adsecurity.org/?feed=rss2" title="Subscribe to Tech, News, and Other Ideations's RSS feed" id="social-id-1" class="mysocial social-rss"> </a> </li> </ul> <button type="button" class="search-toggle navbar-toggle collapsed" data-toggle="collapse" data-target="#top_search"> Toggle search form </button> <div id="top_search" class="top-search-form"> <form class="searchform" method="get" action="https://adsecurity.org"> <div class="input-group"> <div class="form-group live-search-input"> <label for="s" class="screen-reader-text">Search for:</label> <input type="text" id="s" name="s" class="form-control" placeholder="Search"> </div> <button class="btn btn-default" type="submit"></button> </div> </form> </div> </div> </div> <div id="header" class="row"> <img src="https://adsecurity.org/wp-content/themes/graphene/images/headers/fluid.jpg" alt="Active Directory Security" title="Active Directory Security" width="960" height="198" /> </div> <nav class="navbar row navbar-inverse"> <div class="navbar-header align-center"> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#header-menu-wrap, #secondary-menu-wrap"> Toggle navigation </button> <a href="https://adsecurity.org" title="Go back to the front page"> Active Directory Security </a> Active Directory & Enterprise Security, Methods to Secure Active Directory, Attack Methods & Effective Defenses, PowerShell, Tech Notes, & Geek Trivia… </div> <div class="collapse navbar-collapse" id="header-menu-wrap"> <ul class="nav navbar-nav flip"><li ><a href="https://adsecurity.org/">Home</a></li><li class="menu-item menu-item-8"><a href="https://adsecurity.org/?page_id=8" >About</a></li><li class="menu-item menu-item-41"><a href="https://adsecurity.org/?page_id=41" >AD Resources</a></li><li class="menu-item menu-item-4031"><a href="https://adsecurity.org/?page_id=4031" >Attack Defense & Detection</a></li><li class="menu-item menu-item-293"><a href="https://adsecurity.org/?page_id=293" >Contact</a></li><li class="menu-item menu-item-1821"><a href="https://adsecurity.org/?page_id=1821" >Mimikatz</a></li><li class="menu-item menu-item-1352"><a href="https://adsecurity.org/?page_id=1352" >Presentations</a></li><li class="menu-item menu-item-195"><a href="https://adsecurity.org/?page_id=195" >Schema Versions</a></li><li class="menu-item menu-item-399"><a href="https://adsecurity.org/?page_id=399" >Security Resources</a></li><li class="menu-item menu-item-183"><a href="https://adsecurity.org/?page_id=183" >SPNs</a></li><li class="menu-item menu-item-2532"><a href="https://adsecurity.org/?page_id=2532" >Top Posts</a></li></ul> </div> </nav> <div id="content" class="clearfix hfeed row"> <div id="content-main" class="clearfix content-main col-md-8"> <div class="post-nav post-nav-top clearfix"> <a href="https://adsecurity.org/?p=2537" rel="prev">ADSecurity.org in the Press!</a> <a href="https://adsecurity.org/?p=2579" rel="next">Microsoft EMET 5.5 Released – Benefits, New Features, Protection, Logging, & GPO Config</a> </div> <div id="post-2535" class="clearfix post post-2535 type-post status-publish format-standard has-post-thumbnail hentry category-activedirectorysecurity category-microsoft-security tag-applocker tag-emet tag-findadminaccounts tag-findcomputers tag-laps tag-lapsdelegation tag-localadministrator tag-microsoftapplocker tag-microsoftemet tag-ms-mcs-admpwd tag-networkportscan tag-spnscanning item-wrap"> <div class="entry clearfix"> <div class="post-date date alpha with-year"> Jan 27 2016 </div> <h1 class="post-title entry-title"> Active Directory Recon Without Admin Rights </h1> <ul class="post-meta entry-meta clearfix"> <li class="byline"> By <a href="https://adsecurity.org/?author=2" rel="author">Sean Metcalf</a> in <a class="term term-category term-565" href="https://adsecurity.org/?cat=565">ActiveDirectorySecurity</a>, <a class="term term-category term-11" href="https://adsecurity.org/?cat=11">Microsoft Security</a> </li> </ul> <div class="entry-content clearfix"> A fact that is often forgotten (or misunderstood), is that most objects and their attributes can be viewed (read) by authenticated users (most often, domain users). The challenge is that admins may think that since this data is most easily accessible via admin tools such as “Active Directory User and Computers” (dsa.msc) or “Active Directory Administrative Center” (dsac.msc), that others can’t see user data (beyond what is exposed in Outlook’s GAL). This often leads to password data being placed in user object attributes or <a href="https://adsecurity.org/?p=2288">in SYSVOL</a>. There is a lot of data that can be gathered from Active Directory which can be used to update documentation or to recon the environment for the next attack stages. It’s important for defenders to understand the different types of data accessible in AD with a regular user account. Attacks frequently start with a spear-phishing email to one or more users enabling the attacker to get their code running on a computer inside the target network. Once the attacker has their code running inside the enterprise, the first step is performing reconnaissance to discover useful resources to escalate permissions, persist, and of course, plunder information (often the “crown jewels” of an organization). This post shows how an attacker can recon the Active Directory environment with just domain user rights. Many people are surprised when they learn how much information can be gathered from AD without elevated rights. Note: Most of the examples in this post use the Active Directory PowerShell module cmdlets. A good alternative is <a href="https://twitter.com/harmj0y">HarmJ0y’s</a> <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1">PowerView</a> (now part of <a href="https://github.com/PowerShellMafia/PowerSploit">PowerSploit</a>). I spoke about some of these techniques <a href="https://adsecurity.org/?page_id=1352">at several security conferences in 2015 (BSides, Shakacon, Black Hat, DEF CON, & DerbyCon)</a>. I also covered some of these issues in the post “<a href="https://adsecurity.org/?p=1684">The Most Common Active Directory Security Issues and What You Can Do to Fix Them</a>“. Get Active Directory Information I have covered <a href="https://adsecurity.org/?p=113">using .NET in PowerShell to gather AD data</a> before, so I won’t reproduce all of the .NET commands here. Forest Information: <blockquote>PS C:\> [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() Name: lab.adsecurity.org Sites: {Default-First-Site-Name} Domains: {lab.adsecurity.org, child.lab.adsecurity.org} GlobalCatalogs: {ADSDC01.lab.adsecurity.org, ADSDC02.lab.adsecurity.org, ADSDC03.lab.adsecurity.org, ADSDC11.child.lab.adsecurity.org} ApplicationPartitions: {DC=DomainDnsZones,DC=child,DC=lab,DC=adsecurity,DC=org, DC=DomainDnsZones,DC=lab,DC=adsecurity,DC=org, DC=ForestDnsZones,DC=lab,DC=adsecurity,DC=org} ForestMode: Windows2008R2Forest RootDomain: lab.adsecurity.org Schema: CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org SchemaRoleOwner: ADSDC03.lab.adsecurity.org NamingRoleOwner: ADSDC03.lab.adsecurity.org</blockquote> Domain Information: <blockquote>PS C:\> [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() Forest: lab.adsecurity.org DomainControllers: {ADSDC01.lab.adsecurity.org, ADSDC02.lab.adsecurity.org, ADSDC03.lab.adsecurity.org} Children: {child.lab.adsecurity.org} DomainMode: Windows2008R2Domain Parent: PdcRoleOwner: ADSDC03.lab.adsecurity.org RidRoleOwner: ADSDC03.lab.adsecurity.org InfrastructureRoleOwner: ADSDC03.lab.adsecurity.org Name: lab.adsecurity.org</blockquote> Forest Trusts: <blockquote>$ForestRootDomain = ‘lab.adsecurity.org’ ([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext(‘Forest’, $ForestRootDomain)))).GetAllTrustRelationships()  </blockquote> Domain Trusts: <blockquote>PS C:\> ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships() SourceName: lab.adsecurity.org TargetName: child.lab.adsecurity.org TrustType: ParentChild TrustDirection: Bidirectional</blockquote> Get Forest Global Catalogs (typically every Domain Controller is also a GC): <blockquote>PS C:\> [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GlobalCatalogs Forest : lab.adsecurity.org CurrentTime : 1/27/2016 5:31:36 PM HighestCommittedUsn : 305210 OSVersion : Windows Server 2008 R2 Datacenter Roles : {} Domain : lab.adsecurity.org IPAddress : 172.16.11.11 SiteName : Default-First-Site-Name SyncFromAllServersCallback : InboundConnections : {36bfdadf-777d-4bad-9427-bc148cea256f, 48594a5d-c2a3-4cd1-a80d-bedf367cc2a9, 549871d2-e238-4423-a6b8-1bb OutboundConnections : {9da361fd-0eed-414a-b4ee-0a9caa1b153e, 86690811-f995-4c3e-89fe-73c61fa4a3a0, 8797cbb4-fe09-49dc-8891-952 Name : ADSDC01.lab.adsecurity.org Partitions : {DC=lab,DC=adsecurity,DC=org, CN=Configuration,DC=lab,DC=adsecurity,DC=org, CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org, DC=DomainDnsZones,DC=lab,DC=adsecurity,DC=org… Forest : lab.adsecurity.org CurrentTime : 1/27/2016 5:31:37 PM HighestCommittedUsn : 274976 OSVersion : Windows Server 2012 R2 Datacenter Roles : {SchemaRole, NamingRole, PdcRole, RidRole…} Domain : lab.adsecurity.org IPAddress : fe80::1881:40d5:fc2e:e744%12 SiteName : Default-First-Site-Name SyncFromAllServersCallback : InboundConnections : {86690811-f995-4c3e-89fe-73c61fa4a3a0, dd7b36a8-a52e-446d-95a8-318b69bd9765} OutboundConnections : {f901f0b5-8754-44e9-92e8-f56b3d67197b, 549871d2-e238-4423-a6b8-1bb258e2a62f} Name : ADSDC03.lab.adsecurity.org Partitions : {DC=lab,DC=adsecurity,DC=org, CN=Configuration,DC=lab,DC=adsecurity,DC=org, CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org, DC=DomainDnsZones,DC=lab,DC=adsecurity,DC=org… Forest : lab.adsecurity.org CurrentTime : 1/27/2016 5:31:38 PM HighestCommittedUsn : 161898 OSVersion : Windows Server 2012 R2 Datacenter Roles : {PdcRole, RidRole, InfrastructureRole} Domain : child.lab.adsecurity.org IPAddress : 172.16.11.21 SiteName : Default-First-Site-Name SyncFromAllServersCallback : InboundConnections : {612c2d75-1c35-4073-a8a9-d41169665000, 8797cbb4-fe09-49dc-8891-952f38822eda} OutboundConnections : {71ea129f-8d56-4bd0-9b68-d80e89ae7385, 36bfdadf-777d-4bad-9427-bc148cea256f} Name : ADSDC11.child.lab.adsecurity.org Partitions : {CN=Configuration,DC=lab,DC=adsecurity,DC=org, CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org, DC=ForestDnsZones,DC=lab,DC=adsecurity,DC=org, DC=child,DC=lab,DC=adsecurity,DC=org…}</blockquote> Mitigation: There is no reasonable mitigation. This information can not and should not be obfuscated or hidden.   Discover Enterprise Services without Network Scanning The simplest recon method is to use what I call “<a href="https://adsecurity.org/?p=1508">SPN Scanning</a>” which asks the Domain Controller for all Service Principal Names (SPNs) of a specific type. This enables the attacker to discover all SQL servers, Exchange servers, etc. I maintain a <a href="https://adsecurity.org/?page_id=183">SPN directory list which includes the most common SPNs</a> found in an enterprise. SPN scanning can also discover what Windows computers have RDP enabled (TERMSERV), WinRM enabled (WSMAN), etc. Note: In order to discover all enteprise services, target both computers and users (service accounts). <blockquote>PS C:\> get-adcomputer -filter {ServicePrincipalName -like “*TERMSRV*”} -Properties OperatingSystem,OperatingSystemVersion,OperatingSystemServicePack, PasswordLastSet,LastLogonDate,ServicePrincipalName,TrustedForDelegation,TrustedtoAuthForDelegation DistinguishedName : CN=ADSDC02,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC02.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:46:18 AM Name : ADSDC02 ObjectClass : computer ObjectGUID : 1efe44af-d8d9-420b-a66a-8d771d295085 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 6:34:15 AM SamAccountName : ADSDC02$ ServicePrincipalName : {DNS/ADSDC02.lab.adsecurity.org, HOST/ADSDC02/ADSECLAB, HOST/ADSDC02.lab.adsecurity.org/ADSECLAB, GC/ADSDC02.lab.adsecurity.org/lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1103 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSDC01,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC01.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:47:21 AM Name : ADSDC01 ObjectClass : computer ObjectGUID : 31b2038d-e63d-4cfe-b7b6-77206c325af9 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 6:34:14 AM SamAccountName : ADSDC01$ ServicePrincipalName : {ldap/ADSDC01.lab.adsecurity.org/ForestDnsZones.lab.adsecurity.org, ldap/ADSDC01.lab.adsecurity.org/DomainDnsZones.lab.adsecurity.org, TERMSRV/ADSDC01, TERMSRV/ADSDC01.lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1000 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSDC03,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC03.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:35:16 AM Name : ADSDC03 ObjectClass : computer ObjectGUID : 0a2d849c-cc59-4785-8ba2-997fd6ca4dc8 OperatingSystem : Windows Server 2012 R2 Datacenter OperatingSystemServicePack : OperatingSystemVersion : 6.3 (9600) PasswordLastSet : 12/31/2015 6:34:16 AM SamAccountName : ADSDC03$ ServicePrincipalName : {DNS/ADSDC03.lab.adsecurity.org, HOST/ADSDC03.lab.adsecurity.org/ADSECLAB, RPC/c8e1e99e-2aaa-4888-a5d8-23a4355fac48._msdcs.lab.adsecurity.org, GC/ADSDC03.lab.adsecurity.org/lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1601 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSWRKWIN7,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWRKWIN7.lab.adsecurity.org Enabled : True LastLogonDate : 8/29/2015 6:40:16 PM Name : ADSWRKWIN7 ObjectClass : computer ObjectGUID : e8b3bed2-75b4-4512-a4f0-6d9c2d975c70 OperatingSystem : Windows 7 Enterprise OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 8/29/2015 6:40:12 PM SamAccountName : ADSWRKWIN7$ ServicePrincipalName : {TERMSRV/ADSWRKWin7.lab.adsecurity.org, TERMSRV/ADSWRKWIN7, RestrictedKrbHost/ADSWRKWIN7, HOST/ADSWRKWIN7…} SID : S-1-5-21-1581655573-3923512380-696647894-1104 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSAP01,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP01.lab.adsecurity.org Enabled : True LastLogonDate : 1/24/2016 11:03:41 AM Name : ADSAP01 ObjectClass : computer ObjectGUID : b79bb5e3-8f9e-4ee0-a30c-5f66b61da681 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 1/4/2016 6:38:16 AM SamAccountName : ADSAP01$ ServicePrincipalName : {WSMAN/ADSAP01.lab.adsecurity.org, WSMAN/ADSAP01, TERMSRV/ADSAP01.lab.adsecurity.org, TERMSRV/ADSAP01…} SID : S-1-5-21-1581655573-3923512380-696647894-1105 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSWKWIN7,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWKWIN7.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 7:07:11 AM Name : ADSWKWIN7 ObjectClass : computer ObjectGUID : 2f164d63-d721-4b0e-a553-3ca0e272aa96 OperatingSystem : Windows 7 Enterprise OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 8:03:05 AM SamAccountName : ADSWKWIN7$ ServicePrincipalName : {TERMSRV/ADSWKWin7.lab.adsecurity.org, TERMSRV/ADSWKWIN7, RestrictedKrbHost/ADSWKWIN7, HOST/ADSWKWIN7…} SID : S-1-5-21-1581655573-3923512380-696647894-1602 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSAP02,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP02.lab.adsecurity.org Enabled : True LastLogonDate : 1/24/2016 7:39:48 AM Name : ADSAP02 ObjectClass : computer ObjectGUID : 1006978e-8627-4d01-98b6-3215c4ee4541 OperatingSystem : Windows Server 2012 R2 Datacenter OperatingSystemServicePack : OperatingSystemVersion : 6.3 (9600) PasswordLastSet : 1/4/2016 6:39:25 AM SamAccountName : ADSAP02$ ServicePrincipalName : {WSMAN/ADSAP02.lab.adsecurity.org, WSMAN/ADSAP02, TERMSRV/ADSAP02.lab.adsecurity.org, TERMSRV/ADSAP02…} SID : S-1-5-21-1581655573-3923512380-696647894-1603 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName :</blockquote> Mitigation: There is no mitigation. <a href="https://adsecurity.org/?p=230">Service Principal Names are required for Kerberos to work</a>.   Discover Enterprise Services without Network Scanning Part 2 SPN Scanning will discover all enterprise services supporting Kerberos. Other enterprise services that integrate with Active Directory often create a new container in the Domain “System” container (CN=System,DC=<domain>). Some enterprise applications that store data in the domain System container include: <ul> <li>SCCM: “System Management”</li> </ul> There are some applications like Exchange that create containers in the forest configuration partition “Services” container (CN=Services,CN=Configuration,DC=<domain>). Mitigation: There is no reasonable mitigation.   Discover Service Accounts The quickest way to find Service Accounts and the servers the accounts are used on is to SPN Scan for user accounts with Service Principal Names. My <a href="https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Find-PSServiceAccounts">Find-PSServiceAccounts</a> PowerShell script in <a href="https://github.com/PyroTek3/PowerShell-AD-Recon">my GitHub repository</a> performs the sme query without requiring the AD PowerShell module. <blockquote>PS C:\> get-aduser -filter {ServicePrincipalName -like “*”} -Properties PasswordLastSet,LastLogonDate,ServicePrincipalName,TrustedForDelegation,Truste dtoAuthForDelegation DistinguishedName : CN=svc-adsMSSQL11,OU=Test,DC=lab,DC=adsecurity,DC=org Enabled : False GivenName : LastLogonDate : Name : svc-adsMSSQL11 ObjectClass : user ObjectGUID : 275d3bf4-80d3-42ba-9d77-405c5cc63c07 PasswordLastSet : 1/4/2016 7:13:03 AM SamAccountName : svc-adsMSSQL11 ServicePrincipalName : {MSSQL/adsMSSQL11.lab.adsecurity.org:7434} SID : S-1-5-21-1581655573-3923512380-696647894-3601 Surname : TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=svc-adsSQLSA,OU=Test,DC=lab,DC=adsecurity,DC=org Enabled : False GivenName : LastLogonDate : Name : svc-adsSQLSA ObjectClass : user ObjectGUID : 56faaab2-5b05-4bb2-aaea-0bdc1409eab3 PasswordLastSet : 1/4/2016 7:13:13 AM SamAccountName : svc-adsSQLSA ServicePrincipalName : {MSSQL/adsMSSQL23.lab.adsecurity.org:7434, MSSQL/adsMSSQL22.lab.adsecurity.org:5534, MSSQL/adsMSSQL21.lab.adsecurity.org:9834, MSSQL/adsMSSQL10.lab.adsecurity.org:14434…} SID : S-1-5-21-1581655573-3923512380-696647894-3602 Surname : TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=svc-adsMSSQL10,OU=Test,DC=lab,DC=adsecurity,DC=org Enabled : False GivenName : LastLogonDate : Name : svc-adsMSSQL10 ObjectClass : user ObjectGUID : 6c2f15a2-ba4a-485a-a367-39395ad82c86 PasswordLastSet : 1/4/2016 7:13:24 AM SamAccountName : svc-adsMSSQL10 ServicePrincipalName : {MSSQL/adsMSSQL10.lab.adsecurity.org:7434} SID : S-1-5-21-1581655573-3923512380-696647894-3603 Surname : TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName :</blockquote> Mitigation: There is no reasonable mitigation.   Discover Computers without Network Scanning Every computer that joins Active Directory has an associated computer account in AD. When the computer is joined, there are several attributes associated with this computer object that are updated, several of which are quite useful. These include: <ul> <li>Created</li> <li>Modified</li> <li>Enabled</li> <li>Description</li> <li>LastLogonDate (Reboot)</li> <li>PrimaryGroupID (516 = DC)</li> <li>PasswordLastSet (Active/Inactive)OperatingSystem</li> <li>OperatingSystemVersion</li> <li>OperatingSystemServicePack</li> <li>PasswordLastSet</li> <li>LastLogonDate (PowerShell cmdlet attribute)</li> <li>ServicePrincipalName</li> <li><a href="https://adsecurity.org/?p=1667">TrustedForDelegation</a></li> <li>TrustedToAuthForDelegation</li> </ul>   <blockquote>PS C:\> get-adcomputer -filter {PrimaryGroupID -eq “515”} -Properties OperatingSystem,OperatingSystemVersion,OperatingSystemServicePack,Passwo t,LastLogonDate,ServicePrincipalName,TrustedForDelegation,TrustedtoAuthForDelegation DistinguishedName : CN=ADSWRKWIN7,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWRKWIN7.lab.adsecurity.org Enabled : True LastLogonDate : 8/29/2015 6:40:16 PM Name : ADSWRKWIN7 ObjectClass : computer ObjectGUID : e8b3bed2-75b4-4512-a4f0-6d9c2d975c70 OperatingSystem : Windows 7 Enterprise OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 8/29/2015 6:40:12 PM SamAccountName : ADSWRKWIN7$ ServicePrincipalName : {TERMSRV/ADSWRKWin7.lab.adsecurity.org, TERMSRV/ADSWRKWIN7, RestrictedKrbHost/ADSWRKWIN7, HOST/ADSWRKWIN7…} SID : S-1-5-21-1581655573-3923512380-696647894-1104 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSAP01,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP01.lab.adsecurity.org Enabled : True LastLogonDate : 1/24/2016 11:03:41 AM Name : ADSAP01 ObjectClass : computer ObjectGUID : b79bb5e3-8f9e-4ee0-a30c-5f66b61da681 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 1/4/2016 6:38:16 AM SamAccountName : ADSAP01$ ServicePrincipalName : {WSMAN/ADSAP01.lab.adsecurity.org, WSMAN/ADSAP01, TERMSRV/ADSAP01.lab.adsecurity.org, TERMSRV/ADSAP01…} SID : S-1-5-21-1581655573-3923512380-696647894-1105 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSWKWIN7,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWKWIN7.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 7:07:11 AM Name : ADSWKWIN7 ObjectClass : computer ObjectGUID : 2f164d63-d721-4b0e-a553-3ca0e272aa96 OperatingSystem : Windows 7 Enterprise OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 8:03:05 AM SamAccountName : ADSWKWIN7$ ServicePrincipalName : {TERMSRV/ADSWKWin7.lab.adsecurity.org, TERMSRV/ADSWKWIN7, RestrictedKrbHost/ADSWKWIN7, HOST/ADSWKWIN7…} SID : S-1-5-21-1581655573-3923512380-696647894-1602 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSAP02,CN=Computers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP02.lab.adsecurity.org Enabled : True LastLogonDate : 1/24/2016 7:39:48 AM Name : ADSAP02 ObjectClass : computer ObjectGUID : 1006978e-8627-4d01-98b6-3215c4ee4541 OperatingSystem : Windows Server 2012 R2 Datacenter OperatingSystemServicePack : OperatingSystemVersion : 6.3 (9600) PasswordLastSet : 1/4/2016 6:39:25 AM SamAccountName : ADSAP02$ ServicePrincipalName : {WSMAN/ADSAP02.lab.adsecurity.org, WSMAN/ADSAP02, TERMSRV/ADSAP02.lab.adsecurity.org, TERMSRV/ADSAP02…} SID : S-1-5-21-1581655573-3923512380-696647894-1603 TrustedForDelegation : False TrustedToAuthForDelegation : False UserPrincipalName :</blockquote> The same data for Domain Controllers can be gathered by changing the PrimaryGroupID value to “516”, or get all computers by changing to “-filter *”. <blockquote>PS C:\> get-adcomputer -filter {PrimaryGroupID -eq “516”} -Properties OperatingSystem,OperatingSystemVersion,OperatingSystemServicePack,PasswordLastSe t,LastLogonDate,ServicePrincipalName,TrustedForDelegation,TrustedtoAuthForDelegation DistinguishedName : CN=ADSDC02,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC02.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:46:18 AM Name : ADSDC02 ObjectClass : computer ObjectGUID : 1efe44af-d8d9-420b-a66a-8d771d295085 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 6:34:15 AM SamAccountName : ADSDC02$ ServicePrincipalName : {DNS/ADSDC02.lab.adsecurity.org, HOST/ADSDC02/ADSECLAB, HOST/ADSDC02.lab.adsecurity.org/ADSECLAB, GC/ADSDC02.lab.adsecurity.org/lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1103 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSDC01,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC01.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:47:21 AM Name : ADSDC01 ObjectClass : computer ObjectGUID : 31b2038d-e63d-4cfe-b7b6-77206c325af9 OperatingSystem : Windows Server 2008 R2 Datacenter OperatingSystemServicePack : Service Pack 1 OperatingSystemVersion : 6.1 (7601) PasswordLastSet : 12/31/2015 6:34:14 AM SamAccountName : ADSDC01$ ServicePrincipalName : {ldap/ADSDC01.lab.adsecurity.org/ForestDnsZones.lab.adsecurity.org, ldap/ADSDC01.lab.adsecurity.org/DomainDnsZones.lab.adsecurity.org, TERMSRV/ADSDC01, TERMSRV/ADSDC01.lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1000 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName : DistinguishedName : CN=ADSDC03,OU=Domain Controllers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSDC03.lab.adsecurity.org Enabled : True LastLogonDate : 1/20/2016 6:35:16 AM Name : ADSDC03 ObjectClass : computer ObjectGUID : 0a2d849c-cc59-4785-8ba2-997fd6ca4dc8 OperatingSystem : Windows Server 2012 R2 Datacenter OperatingSystemServicePack : OperatingSystemVersion : 6.3 (9600) PasswordLastSet : 12/31/2015 6:34:16 AM SamAccountName : ADSDC03$ ServicePrincipalName : {DNS/ADSDC03.lab.adsecurity.org, HOST/ADSDC03.lab.adsecurity.org/ADSECLAB, RPC/c8e1e99e-2aaa-4888-a5d8-23a4355fac48._msdcs.lab.adsecurity.org, GC/ADSDC03.lab.adsecurity.org/lab.adsecurity.org…} SID : S-1-5-21-1581655573-3923512380-696647894-1601 TrustedForDelegation : True TrustedToAuthForDelegation : False UserPrincipalName :</blockquote> This provides useful information on Windows OS versions as well as non-Windows devices joined to Active Directory. Some example queries for finding non-Windows devices: <ul> <li>OperatingSystem -Like “*Samba*”</li> <li>OperatingSystem -Like “*OnTap*”</li> <li>OperatingSystem -Like “*Data Domain*”</li> <li>OperatingSystem -Like “*EMC*”</li> <li>OperatingSystem -Like “*Windows NT*”</li> </ul> Mitigation: There is no mitigation.   Identify Admin Accounts There are two effective methods for discovering accounts with elevated rights in Active Directory. The first is the standard group enumeration method which identifies all members of the standard Active Directory admin groups: Domain Admins, Administrators, Enterprise Admins, etc. Typically getting recursive group membership for the domain “Adminsitrators” group will provide a list of all AD admins. The second method, which I highlighted at <a href="https://adsecurity.org/?page_id=1352">DerbyCon in 2015</a>, involves identifying all accounts which have the attribute “AdminCount” set to 1. The caveat to this is that there may be accounts returned in this query which no longer have admin rights since this value isn’t automatically reset once the account is removed from the admin groups. More info on SDProp and the AdminCount attribute: “<a href="https://adsecurity.org/?p=1906">Sneaky Active Directory Persistence #15: Leverage AdminSDHolder & SDProp to (Re)Gain Domain Admin Rights</a>“. <blockquote>PS C:\> get-aduser -filter {AdminCount -eq 1} -Properties Name,AdminCount,ServicePrincipalName,PasswordLastSet,LastLogonDate,MemberOf AdminCount : 1 DistinguishedName : CN=ADSAdministrator,CN=Users,DC=lab,DC=adsecurity,DC=org Enabled : True GivenName : LastLogonDate : 1/27/2016 8:55:48 AM MemberOf : {CN=Administrators,CN=Builtin,DC=lab,DC=adsecurity,DC=org, CN=Schema Admins,CN=Users,DC=lab,DC=adsecurity,DC=org, CN=Group Policy Creator Owners,CN=Users,DC=lab,DC=adsecurity,DC=org, CN=Enterprise Admins,CN=Users,DC=lab,DC=adsecurity,DC=org…} Name : ADSAdministrator ObjectClass : user ObjectGUID : 72ac7731-0a76-4e5a-8e5d-b4ded9a304b5 PasswordLastSet : 12/31/2015 8:45:27 AM SamAccountName : ADSAdministrator SID : S-1-5-21-1581655573-3923512380-696647894-500 Surname : UserPrincipalName : AdminCount : 1 DistinguishedName : CN=krbtgt,CN=Users,DC=lab,DC=adsecurity,DC=org Enabled : False GivenName : LastLogonDate : MemberOf : {CN=Denied RODC Password Replication Group,CN=Users,DC=lab,DC=adsecurity,DC=org} Name : krbtgt ObjectClass : user ObjectGUID : 3d5be8dd-df7f-4f84-b2cf-4556310a7292 PasswordLastSet : 8/27/2015 7:10:22 PM SamAccountName : krbtgt ServicePrincipalName : {kadmin/changepw} SID : S-1-5-21-1581655573-3923512380-696647894-502 Surname : UserPrincipalName : AdminCount : 1 DistinguishedName : CN=LukeSkywalker,OU=AD Management,DC=lab,DC=adsecurity,DC=org Enabled : True GivenName : LastLogonDate : 8/29/2015 7:29:52 PM MemberOf : {CN=Domain Admins,CN=Users,DC=lab,DC=adsecurity,DC=org} Name : LukeSkywalker ObjectClass : user ObjectGUID : 32b5226b-aa6d-4b35-a031-ddbcbde07137 PasswordLastSet : 8/29/2015 7:26:02 PM SamAccountName : LukeSkywalker SID : S-1-5-21-1581655573-3923512380-696647894-2629 Surname : UserPrincipalName :</blockquote> Note: These methods will not return admin accounts with custom delegation – admin accounts that aren’t ultimately a member of the standard AD groups. Mitigation: There is no mitigation. Expect attackers to know more about what accounts have elevated rights to important resources.   Find Admin Groups Most organizations have custom admin groups which have different naming schemes, though most include the word “admin”. Asking AD for all security groups with “admin” in the name is a quick way to get a list. <blockquote>PS C:\> get-adgroup -filter {GroupCategory -eq ‘Security’ -AND Name -like “*admin*”} DistinguishedName : CN=Domain Admins,CN=Users,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : Global Name : Domain Admins ObjectClass : group ObjectGUID : 5621cc71-d318-4e2c-b1b1-c181f630e10e SamAccountName : Domain Admins SID : S-1-5-21-1581655573-3923512380-696647894-512 DistinguishedName : CN=Workstation Admins,OU=AD Management,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : Global Name : Workstation Admins ObjectClass : group ObjectGUID : 88cd4d52-aedb-4f90-9ebd-02d4c0e322e4 SamAccountName : WorkstationAdmins SID : S-1-5-21-1581655573-3923512380-696647894-2627 DistinguishedName : CN=Server Admins,OU=AD Management,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : Global Name : Server Admins ObjectClass : group ObjectGUID : 3877c311-9321-41c0-a6b5-c0d88684b335 SamAccountName : ServerAdmins SID : S-1-5-21-1581655573-3923512380-696647894-2628 DistinguishedName : CN=DnsAdmins,CN=Users,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : DomainLocal Name : DnsAdmins ObjectClass : group ObjectGUID : 46caa0dd-6a22-42a3-a2d9-bd467934aab5 SamAccountName : DnsAdmins SID : S-1-5-21-1581655573-3923512380-696647894-1101 DistinguishedName : CN=Administrators,CN=Builtin,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : DomainLocal Name : Administrators ObjectClass : group ObjectGUID : d03a4afc-b14e-48c6-893c-bbc1ac872ca2 SamAccountName : Administrators SID : S-1-5-32-544 DistinguishedName : CN=Hyper-V Administrators,CN=Builtin,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : DomainLocal Name : Hyper-V Administrators ObjectClass : group ObjectGUID : 3137943e-f1c3-46d0-acf2-4711bf6f8417 SamAccountName : Hyper-V Administrators SID : S-1-5-32-578 DistinguishedName : CN=Enterprise Admins,CN=Users,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : Universal Name : Enterprise Admins ObjectClass : group ObjectGUID : 7674d6ad-777b-4db1-9fe3-e31fd664eb6e SamAccountName : Enterprise Admins SID : S-1-5-21-1581655573-3923512380-696647894-519 DistinguishedName : CN=Schema Admins,CN=Users,DC=lab,DC=adsecurity,DC=org GroupCategory : Security GroupScope : Universal Name : Schema Admins ObjectClass : group ObjectGUID : 420e8ee5-77f5-43b8-9f51-cde3feea0662 SamAccountName : Schema Admins SID : S-1-5-21-1581655573-3923512380-696647894-518</blockquote>   Identify Partner Organizations External email addresses are added to the organization’s Global Address List (GAL) in order to facilitate collaboration among partner organization. These email addresses are created as contact objects in Active Directory. <blockquote>PS C:\> get-adobject -filter {ObjectClass -eq “Contact”} -Prop * CanonicalName : lab.adsecurity.org/Contaxts/Admiral Ackbar CN : Admiral Ackbar Created : 1/27/2016 10:00:06 AM createTimeStamp : 1/27/2016 10:00:06 AM Deleted : Description : DisplayName : DistinguishedName : CN=Admiral Ackbar,OU=Contaxts,DC=lab,DC=adsecurity,DC=org dSCorePropagationData : {12/31/1600 4:00:00 PM} givenName : Admiral instanceType : 4 isDeleted : LastKnownParent : mail : admackbar@RebelFleet.org Modified : 1/27/2016 10:00:24 AM modifyTimeStamp : 1/27/2016 10:00:24 AM Name : Admiral Ackbar nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity ObjectCategory : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org ObjectClass : contact ObjectGUID : 52c80a1d-a614-4889-92d4-1f588387d9f3 ProtectedFromAccidentalDeletion : False sDRightsEffective : 15 sn : Ackbar uSNChanged : 275113 uSNCreated : 275112 whenChanged : 1/27/2016 10:00:24 AM whenCreated : 1/27/2016 10:00:06 AM CanonicalName : lab.adsecurity.org/Contaxts/Leia Organa CN : Leia Organa Created : 1/27/2016 10:01:25 AM createTimeStamp : 1/27/2016 10:01:25 AM Deleted : Description : DisplayName : DistinguishedName : CN=Leia Organa,OU=Contaxts,DC=lab,DC=adsecurity,DC=org dSCorePropagationData : {12/31/1600 4:00:00 PM} givenName : Leia instanceType : 4 isDeleted : LastKnownParent : mail : LeiaOrgana@TheAlliance.org Modified : 1/27/2016 10:09:15 AM modifyTimeStamp : 1/27/2016 10:09:15 AM Name : Leia Organa nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity ObjectCategory : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org ObjectClass : contact ObjectGUID : ba8ec318-a0a2-41d5-923e-a3f646d1c7f9 ProtectedFromAccidentalDeletion : False sDRightsEffective : 15 sn : Organa uSNChanged : 275157 uSNCreated : 275132 whenChanged : 1/27/2016 10:09:15 AM whenCreated : 1/27/2016 10:01:25 AM</blockquote> Mitigation: The only mitigation is to not place contact objects in Active Directory which may no bet an option.   Identify Domain Password Policy The domain password policy is easily enumerated using either “net accounts” or the AD PowerShell module “<a href="https://technet.microsoft.com/en-us/library/ee617244.aspx">Get-ADDefaultDomainPasswordPolicy</a>“. <blockquote>PS C:\> Get-ADDefaultDomainPasswordPolicy ComplexityEnabled : True DistinguishedName : DC=lab,DC=adsecurity,DC=org LockoutDuration : 00:30:00 LockoutObservationWindow : 00:30:00 LockoutThreshold : 0 MaxPasswordAge : 42.00:00:00 MinPasswordAge : 1.00:00:00 MinPasswordLength : 7 objectClass : {domainDNS} objectGuid : bbf0907c-3171-4448-b33a-76a48d859039 PasswordHistoryCount : 24 ReversibleEncryptionEnabled : False</blockquote> Mitigation: There is no reasonable mitigation.   Identify Fine-Grained Password Policies If the Domain Functional Level (DFL) is set to “Windows Server 2008” or higher, a new feature called Fine-Grained Password Policy (FGPP) is available to provide a wide-variety of password policies that can be applied to users or groups (not OUs). While Microsoft made Fine-Grained Password Policies available starting with Windows Server 2008 (DFL), the Active Directory Administrative Center (ADAC) wasn’t updated to support FGPP administration until Windows Server 2012. Enabling “Advanced Features” from the “View” menu option in Active Directory Users and Computers and then browsing down to System, Password Settings Container (CN=Password Settings Container,CN=System,DC=DOMAIN,DC=COM) will typically display any domain FGPP objects. Note that if “Advanced Features” is not enabled, the System container is not visible. FGPP over-rides the domain password policy settings and can be used to require stricter password policies or enable less-restrictive settings for a subset of domain users. <blockquote>PS C:\> Get-ADFineGrainedPasswordPolicy -Filter * AppliesTo : {CN=Special FGPP Users,OU=Test,DC=lab,DC=adsecurity,DC=org} ComplexityEnabled : True DistinguishedName : CN=Special Password Policy Group,CN=Password Settings Container,CN=System,DC=lab,DC=adsecurity,DC=org LockoutDuration : 12:00:00 LockoutObservationWindow : 00:15:00 LockoutThreshold : 10 MaxPasswordAge : 00:00:00.0000365 MinPasswordAge : 00:00:00 MinPasswordLength : 7 Name : Special Password Policy Group ObjectClass : msDS-PasswordSettings ObjectGUID : c1301d8f-ba52-4bb3-b160-c449d9c7b8f8 PasswordHistoryCount : 24 Precedence : 100 ReversibleEncryptionEnabled : True</blockquote> Mitigation: There is no reasonable mitigation.   Identify Managed Service Accounts & Group Managed Service Accounts Microsoft added <a href="https://technet.microsoft.com/en-us/library/dd548356%28v=ws.10%29.aspx">Managed Service Accounts (MSAs)</a> as a new feature with Windows Server 2008 R2 DFL which automatically manages and updates the MSA password. The key limitation is that a MSA can only be linked to a single computer running Windows 7 or Windows Server 2008 R2 (or newer). Windows Server 2012 DFL introduced a needed update to MSAs called <a href="https://technet.microsoft.com/en-us/library/jj128431.aspx">group Managed Service Accounts (gMSAs)</a> which enable gMSAs to be linked to any number of computers running Windows 8 or Windows Server 2012 (or newer). Once the DFL is raised to Windows Server 2012 or newer, the default AD Service Account creation option creates a new gMSA (using the AD PowerShell module cmdlet <a href="https://technet.microsoft.com/en-us/library/ee617211.aspx">New-ADServiceAccount, for example</a>). Before creating a gMSA, the KDS Root key needs to be created (Add-KDSRootKey –EffectiveImmediately). <blockquote>PS C:\> Get-ADServiceAccount -Filter * -Properties * AccountExpirationDate : 12/27/2017 11:14:38 AM accountExpires : 131588756787719890 AccountLockoutTime : AccountNotDelegated : False AllowReversiblePasswordEncryption : False AuthenticationPolicy : {} AuthenticationPolicySilo : {} BadLogonCount : 0 badPasswordTime : 0 badPwdCount : 0 CannotChangePassword : False CanonicalName : lab.adsecurity.org/Managed Service Accounts/ADSMSA12 Certificates : {} CN : ADSMSA12 codePage : 0 CompoundIdentitySupported : {False} countryCode : 0 Created : 1/27/2016 11:14:38 AM createTimeStamp : 1/27/2016 11:14:38 AM Deleted : Description : gMSA for XYZ App DisplayName : ADSMSA12 DistinguishedName : CN=ADSMSA12,CN=Managed Service Accounts,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP02.lab.adsecurity.org DoesNotRequirePreAuth : False dSCorePropagationData : {12/31/1600 4:00:00 PM} Enabled : True HomedirRequired : False HomePage : HostComputers : {} instanceType : 4 isCriticalSystemObject : False isDeleted : KerberosEncryptionType : {RC4, AES128, AES256} LastBadPasswordAttempt : LastKnownParent : lastLogoff : 0 lastLogon : 0 LastLogonDate : localPolicyFlags : 0 LockedOut : False logonCount : 0 ManagedPasswordIntervalInDays : {21} MemberOf : {} MNSLogonAccount : False Modified : 1/27/2016 11:14:39 AM modifyTimeStamp : 1/27/2016 11:14:39 AM msDS-ManagedPasswordId : {1, 0, 0, 0…} msDS-ManagedPasswordInterval : 21 msDS-SupportedEncryptionTypes : 28 msDS-User-Account-Control-Computed : 0 Name : ADSMSA12 nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity ObjectCategory : CN=ms-DS-Group-Managed-Service-Account,CN=Schema,CN=Configuration,DC=lab,DC=adsecurity,DC=org ObjectClass : msDS-GroupManagedServiceAccount ObjectGUID : fe4c287b-f9d2-45ce-abe3-4acd6d09c3ff objectSid : S-1-5-21-1581655573-3923512380-696647894-3605 PasswordExpired : False PasswordLastSet : 1/27/2016 11:14:38 AM PasswordNeverExpires : False PasswordNotRequired : False PrimaryGroup : CN=Domain Computers,CN=Users,DC=lab,DC=adsecurity,DC=org primaryGroupID : 515 PrincipalsAllowedToDelegateToAccount : {} PrincipalsAllowedToRetrieveManagedPassword : {} ProtectedFromAccidentalDeletion : False pwdLastSet : 130983956789440119 SamAccountName : ADSMSA12$ sAMAccountType : 805306369 sDRightsEffective : 15 ServicePrincipalNames : SID : S-1-5-21-1581655573-3923512380-696647894-3605 SIDHistory : {} TrustedForDelegation : False TrustedToAuthForDelegation : False UseDESKeyOnly : False userAccountControl : 4096 userCertificate : {} UserPrincipalName : uSNChanged : 275383 uSNCreated : 275380 whenChanged : 1/27/2016 11:14:39 AM whenCreated : 1/27/2016 11:14:38 AM</blockquote> Mitigation: There is no reasonable mitigation.   Identify Groups with Local Admin Rights to Workstations/Servers <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1">PowerView</a> has incorporated this functionality (<a href="https://twitter.com/harmj0y">@HarmJ0y</a> beat me to it! 🙂 ). Group Policy provides the ability, via Restricted Groups, to enforce local group membership such as the Administrators groups on all computers in an OU. This can be tracked back by identifying the GPOs that are using restricted groups and the OUs they are applied to. This provides the AD groups that have admin rights and the associated list of computers. Using <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1">PowerView</a> (part of <a href="https://github.com/PowerShellMafia/PowerSploit">PowerSploit</a>), we can quickly identify GPOs that include Restricted Groups. <blockquote>PS C:\> Get-NetGPOGroup GPOName : {E9CABE0F-3A3F-40B1-B4C1-1FA89AC1F212} GPOPath : \\lab.adsecurity.org\SysVol\lab.adsecurity.org\Policies\{E9CABE0F-3A3F-40B1-B4C1-1FA89AC1F212} Members : {Server Admins} MemberOf : {Administrators} GPODisplayName : Add Server Admins to Local Administrator Group Filters : GPOName : {45556105-EFE6-43D8-A92C-AACB1D3D4DE5} GPOPath : \\lab.adsecurity.org\SysVol\lab.adsecurity.org\Policies\{45556105-EFE6-43D8-A92C-AACB1D3D4DE5} Members : {Workstation Admins} MemberOf : {Administrators} GPODisplayName : Add Workstation Admins to Local Administrators Group</blockquote> Once we have this information, we can check what to what OUs the GPOs link using a <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1">PowerView</a> cmdlet. <blockquote>PS C:\> get-netOU -guid “E9CABE0F-3A3F-40B1-B4C1-1FA89AC1F212” LDAP://OU=Servers,DC=lab,DC=adsecurity,DC=org PS C:\> get-netOU -guid “45556105-EFE6-43D8-A92C-AACB1D3D4DE5” LDAP://OU=Workstations,DC=lab,DC=adsecurity,DC=org</blockquote> Next, we identify the computers in these OUs <blockquote>PS C:\> get-adcomputer -filter * -SearchBase “OU=Servers,DC=lab,DC=adsecurity,DC=org” DistinguishedName : CN=ADSAP01,OU=Servers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP01.lab.adsecurity.org Enabled : True Name : ADSAP01 ObjectClass : computer ObjectGUID : b79bb5e3-8f9e-4ee0-a30c-5f66b61da681 SamAccountName : ADSAP01$ SID : S-1-5-21-1581655573-3923512380-696647894-1105 UserPrincipalName : DistinguishedName : CN=ADSAP02,OU=Servers,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSAP02.lab.adsecurity.org Enabled : True Name : ADSAP02 ObjectClass : computer ObjectGUID : 1006978e-8627-4d01-98b6-3215c4ee4541 SamAccountName : ADSAP02$ SID : S-1-5-21-1581655573-3923512380-696647894-1603 UserPrincipalName :   PS C:\> get-adcomputer -filter * -SearchBase “OU=Workstations,DC=lab,DC=adsecurity,DC=org” DistinguishedName : CN=ADSWRKWIN7,OU=Workstations,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWRKWIN7.lab.adsecurity.org Enabled : True Name : ADSWRKWIN7 ObjectClass : computer ObjectGUID : e8b3bed2-75b4-4512-a4f0-6d9c2d975c70 SamAccountName : ADSWRKWIN7$ SID : S-1-5-21-1581655573-3923512380-696647894-1104 UserPrincipalName : DistinguishedName : CN=ADSWKWIN7,OU=Workstations,DC=lab,DC=adsecurity,DC=org DNSHostName : ADSWKWIN7.lab.adsecurity.org Enabled : True Name : ADSWKWIN7 ObjectClass : computer ObjectGUID : 2f164d63-d721-4b0e-a553-3ca0e272aa96 SamAccountName : ADSWKWIN7$ SID : S-1-5-21-1581655573-3923512380-696647894-1602 UserPrincipalName :</blockquote> Using a few PowerShell commands, we are able to identify what AD groups are configured via GPO with full admin rights on computers in the domain. Mitigation: The only mitigation is to remove Domain Users from being able to read the GPOs that manage local groups. Only computers in the domain require the ability to read and process these GPOs. Note that once an attacker gains admin rights on a single computer in the domain, they can use the computer account to read the GPO.   Identify Microsoft AppLocker Settings <a href="https://technet.microsoft.com/en-us/library/dd723686%28v=ws.10%29.aspx">Microsoft AppLocker</a> can be used to limit application execution to specific approved applications. There are several difference phases I recommend for AppLocker: <ul> <li>Phase 1: Audit Mode – audit all execution by users and the path they were run from. This logging mode provides information on what programs are run in the enterprise and this data is logged to the event log.</li> <li>Phase 2: “Blacklist Mode” – Configure AppLocker to block execution of any file in a user’s home directory, profile path, and temporary file location the user has write access to, such as c:\temp.</li> <li>Phase 3: “Folder Whitelist Mode” – Configure AppLocker to build on Phase 2 by adding new rules to only allow execution of files in specific folders such as c:\Windows and c:\Program Files.</li> <li>Phase 4: “Application Whitelisting” – Inventory all applications in use in the enterprise environment and whitelist those applications by location and hash (preferably digital signature). This ensures that only approved organization applications will execute.</li> </ul> The issue is that AppLocker is configured via Group Policy, which is often kept at the default which enables all domain users the ability to read the configuration. Mitigation: The only mitigation is to remove Domain Users from being able to read the GPOs that manage local groups. Only computers in the domain require the ability to read and process these GPOs. Note that once an attacker gains admin rights on a single computer in the domain, they can use the computer account to read the GPO.   Identify Microsoft EMET Settings <a href="https://technet.microsoft.com/en-us/security/jj653751">Microsoft Enhanced Mitigation Experience Toolkit (EMET)</a> helps prevent application vulnerabilities from being exploited (including some 0-days). It’s a free product that effectively “wraps” popular applications so when vulnerability exploitation is attempted, the attempt is stopped at the “wrapper” and doesn’t make it to the OS. Enterprises often use Group Policy to configure EMET, which is often kept at the default which enables all domain users the ability to read the configuration. Mitigation: The only mitigation is to remove Domain Users from being able to read the GPOs that manage local groups. Only computers in the domain require the ability to read and process these GPOs. Note that once an attacker gains admin rights on a single computer in the domain, they can use the computer account to read the GPO.   Identify Microsoft LAPS Delegation <a href="https://adsecurity.org/?p=1790">Microsoft Local Administrator Password Solution (LAPS)</a> is a great option for managing local Administrator account passwords for computers in the enterprise. LAPS adds two new attributes to the AD computer object, one to store the local Admin password and one to track the last time the password was changed. A LAPS GPO is used to configure the LAPS client determining when the password is changed, its length, the account managed, etc. The computer’s local Administrator password is created by the LAPS client on the computer, that password is set as the new value for the LAPS password attribute (ms-Mcs-AdmPwd), and changed locally. In order for the password to be usable by an admin, read access to the ms-Mcs-AdmPwd needs to be delegated. This delegation can be identified by enumerating the security ACLs on the attribute. Mitigation: The only mitigation is to remove Domain Users from being able to read the GPOs that manage local groups. Only computers in the domain require the ability to read and process these GPOs. Note that once an attacker gains admin rights on a single computer in the domain, they can use the computer account to read the GPO.   Discover Admin Credentials in the domain SYSVOL Share Admins often place credentials in scripts or in Group Policy which end up in SYSVOL. More information on this issue including mitigation: “<a href="https://adsecurity.org/?p=2288">Finding Passwords in SYSVOL & Exploiting Group Policy Preferences</a>”   Conclusion These are only a few of the interesting data items which can be easily gathered from Active Directory as a domain user. Expect an attacker to gain a foothold in your enterprise and adjust current strategies accordingly. Note: While I have some scripts that perform many of these actions already, they are not ready for sharing. At some point in fhe future, I may be able to share these. <div class="tptn_counter" id="tptn_counter_2535">(Visited 72,108 times, 8 visits today)</div> </div> <ul class="entry-footer"> <li class="post-tags col-sm-8"> <a class="term term-tagpost_tag term-818" href="https://adsecurity.org/?tag=applocker">AppLocker</a>, <a class="term term-tagpost_tag term-260" href="https://adsecurity.org/?tag=emet">EMET</a>, <a class="term term-tagpost_tag term-814" href="https://adsecurity.org/?tag=findadminaccounts">FindAdminAccounts</a>, <a class="term term-tagpost_tag term-815" href="https://adsecurity.org/?tag=findcomputers">FindComputers</a>, <a class="term term-tagpost_tag term-631" href="https://adsecurity.org/?tag=laps">LAPS</a>, <a class="term term-tagpost_tag term-637" href="https://adsecurity.org/?tag=lapsdelegation">LAPSDelegation</a>, <a class="term term-tagpost_tag term-769" href="https://adsecurity.org/?tag=localadministrator">LocalAdministrator</a>, <a class="term term-tagpost_tag term-817" href="https://adsecurity.org/?tag=microsoftapplocker">MicrosoftAppLocker</a>, <a class="term term-tagpost_tag term-58" href="https://adsecurity.org/?tag=microsoftemet">MicrosoftEMET</a>, <a class="term term-tagpost_tag term-633" href="https://adsecurity.org/?tag=ms-mcs-admpwd">ms-Mcs-AdmPwd</a>, <a class="term term-tagpost_tag term-816" href="https://adsecurity.org/?tag=networkportscan">NetworkPortScan</a>, <a class="term term-tagpost_tag term-471" href="https://adsecurity.org/?tag=spnscanning">SPNScanning</a></li> <li class="addthis col-sm-8"><div class="add-this"></div></li> </ul> </div> </div> <div class="entry-author"> <div class="row"> <div class="author-avatar col-sm-3"> <a href="https://adsecurity.org/?author=2" rel="author"> <img alt='' src='https://secure.gravatar.com/avatar/1f3ad5e878e5d0e6096c5a33718a04d0?s=200&d=mm&r=g' srcset='https://secure.gravatar.com/avatar/1f3ad5e878e5d0e6096c5a33718a04d0?s=400&d=mm&r=g 2x' class='avatar avatar-200 photo' height='200' width='200' decoding='async'/> </a> </div> <div class="author-bio col-sm-9"> <h3 class="section-title-sm">Sean Metcalf</h3> I improve security for enterprises around the world working for TrimarcSecurity.com Read the About page (top left) for information about me. :) https://adsecurity.org/?page_id=8 <ul class="author-social"> <li><a href="mailto:sean@adsecurity.org"></a></li> </ul> </div> </div> </div> </div> <div id="sidebar1" class="sidebar sidebar-right widget-area col-md-4"> <div id="recent-posts-4" class="sidebar-wrap widget_recent_entries"> <h3>Recent Posts</h3> <ul> <li> <a href="https://adsecurity.org/?p=4436">BSides Dublin – The Current State of Microsoft Identity Security: Common Security Issues and Misconfigurations – Sean Metcalf</a> </li> <li> <a href="https://adsecurity.org/?p=4434">DEFCON 2017: Transcript – Hacking the Cloud</a> </li> <li> <a href="https://adsecurity.org/?p=4432">Detecting the Elusive: Active Directory Threat Hunting</a> </li> <li> <a href="https://adsecurity.org/?p=4430">Detecting Kerberoasting Activity</a> </li> <li> <a href="https://adsecurity.org/?p=4428">Detecting Password Spraying with Security Event Auditing</a> </li> </ul> </div><div id="text-3" class="sidebar-wrap widget_text"><h3>Trimarc Active Directory Security Services</h3> <div class="textwidget">Have concerns about your Active Directory environment? Trimarc helps enterprises improve their security posture. <a href="http://trimarcsecurity.com/security-services">Find out how...</a> TrimarcSecurity.com</div> </div><div id="widget_tptn_pop-4" class="sidebar-wrap tptn_posts_list_widget"><h3>Popular Posts</h3><div class="tptn_posts tptn_posts_widget tptn_posts_widget4"><ul><li><a href="https://adsecurity.org/?p=478" class="tptn_link">PowerShell Encoding & Decoding (Base64)</a></li><li><a href="https://adsecurity.org/?p=2362" class="tptn_link">Attack Methods for Gaining Domain Admin Rights in…</a></li><li><a href="https://adsecurity.org/?p=483" class="tptn_link">Kerberos & KRBTGT: Active Directory’s…</a></li><li><a href="https://adsecurity.org/?p=2288" class="tptn_link">Finding Passwords in SYSVOL & Exploiting Group…</a></li><li><a href="https://adsecurity.org/?p=3377" class="tptn_link">Securing Domain Controllers to Improve Active…</a></li><li><a href="https://adsecurity.org/?p=3299" class="tptn_link">Securing Windows Workstations: Developing a Secure Baseline</a></li><li><a href="https://adsecurity.org/?p=3458" class="tptn_link">Detecting Kerberoasting Activity</a></li><li><a href="https://adsecurity.org/?p=1729" class="tptn_link">Mimikatz DCSync Usage, Exploitation, and Detection</a></li><li><a href="https://adsecurity.org/?p=3658" class="tptn_link">Scanning for Active Directory Privileges &…</a></li><li><a href="https://adsecurity.org/?p=3164" class="tptn_link">Microsoft LAPS Security & Active Directory LAPS…</a></li></ul><div class="tptn_clear"></div></div></div><div id="categories-4" class="sidebar-wrap widget_categories"><h3>Categories</h3> <ul> <li class="cat-item cat-item-565"><a href="https://adsecurity.org/?cat=565">ActiveDirectorySecurity</a> </li> <li class="cat-item cat-item-55"><a href="https://adsecurity.org/?cat=55">Apple Security</a> </li> <li class="cat-item cat-item-431"><a href="https://adsecurity.org/?cat=431">Cloud Security</a> </li> <li class="cat-item cat-item-17"><a href="https://adsecurity.org/?cat=17">Continuing Education</a> </li> <li class="cat-item cat-item-396"><a href="https://adsecurity.org/?cat=396">Entertainment</a> </li> <li class="cat-item cat-item-347"><a href="https://adsecurity.org/?cat=347">Exploit</a> </li> <li class="cat-item cat-item-1039"><a href="https://adsecurity.org/?cat=1039">Hacking</a> </li> <li class="cat-item cat-item-168"><a href="https://adsecurity.org/?cat=168">Hardware Security</a> </li> <li class="cat-item cat-item-172"><a href="https://adsecurity.org/?cat=172">Hypervisor Security</a> </li> <li class="cat-item cat-item-126"><a href="https://adsecurity.org/?cat=126">Linux/Unix Security</a> </li> <li class="cat-item cat-item-343"><a href="https://adsecurity.org/?cat=343">Malware</a> </li> <li class="cat-item cat-item-11"><a href="https://adsecurity.org/?cat=11">Microsoft Security</a> </li> <li class="cat-item cat-item-819"><a href="https://adsecurity.org/?cat=819">Mitigation</a> </li> <li class="cat-item cat-item-48"><a href="https://adsecurity.org/?cat=48">Network/System Security</a> </li> <li class="cat-item cat-item-7"><a href="https://adsecurity.org/?cat=7">PowerShell</a> </li> <li class="cat-item cat-item-698"><a href="https://adsecurity.org/?cat=698">RealWorld</a> </li> <li class="cat-item cat-item-21"><a href="https://adsecurity.org/?cat=21">Security</a> </li> <li class="cat-item cat-item-234"><a href="https://adsecurity.org/?cat=234">Security Conference Presentation/Video</a> </li> <li class="cat-item cat-item-1045"><a href="https://adsecurity.org/?cat=1045">Security Recommendation</a> </li> <li class="cat-item cat-item-24"><a href="https://adsecurity.org/?cat=24">Technical Article</a> </li> <li class="cat-item cat-item-4"><a href="https://adsecurity.org/?cat=4">Technical Reading</a> </li> <li class="cat-item cat-item-2"><a href="https://adsecurity.org/?cat=2">Technical Reference</a> </li> <li class="cat-item cat-item-156"><a href="https://adsecurity.org/?cat=156">TheCloud</a> </li> <li class="cat-item cat-item-930"><a href="https://adsecurity.org/?cat=930">Vulnerability</a> </li> </ul> </div><div id="tag_cloud-3" class="sidebar-wrap widget_tag_cloud"><h3>Tags</h3><div class="tagcloud"><a href="https://adsecurity.org/?tag=activedirectory" class="tag-cloud-link tag-link-20 tag-link-position-1" style="font-size: 22pt;" aria-label="ActiveDirectory (55 items)">ActiveDirectory</a> <a href="https://adsecurity.org/?tag=active-directory" class="tag-cloud-link tag-link-75 tag-link-position-2" style="font-size: 10.453608247423pt;" aria-label="Active Directory (8 items)">Active Directory</a> <a href="https://adsecurity.org/?tag=active-directory-security" class="tag-cloud-link tag-link-976 tag-link-position-3" style="font-size: 9.7319587628866pt;" aria-label="Active Directory Security (7 items)">Active Directory Security</a> <a href="https://adsecurity.org/?tag=activedirectorysecurity" class="tag-cloud-link tag-link-113 tag-link-position-4" style="font-size: 13.773195876289pt;" aria-label="ActiveDirectorySecurity (14 items)">ActiveDirectorySecurity</a> <a href="https://adsecurity.org/?tag=adreading" class="tag-cloud-link tag-link-5 tag-link-position-5" style="font-size: 13.340206185567pt;" aria-label="ADReading (13 items)">ADReading</a> <a href="https://adsecurity.org/?tag=ad-security" class="tag-cloud-link tag-link-100 tag-link-position-6" style="font-size: 8pt;" aria-label="AD Security (5 items)">AD Security</a> <a href="https://adsecurity.org/?tag=adsecurity" class="tag-cloud-link tag-link-86 tag-link-position-7" style="font-size: 10.453608247423pt;" aria-label="ADSecurity (8 items)">ADSecurity</a> <a href="https://adsecurity.org/?tag=azure" class="tag-cloud-link tag-link-25 tag-link-position-8" style="font-size: 8pt;" aria-label="Azure (5 items)">Azure</a> <a href="https://adsecurity.org/?tag=azuread" class="tag-cloud-link tag-link-136 tag-link-position-9" style="font-size: 8pt;" aria-label="AzureAD (5 items)">AzureAD</a> <a href="https://adsecurity.org/?tag=dcsync" class="tag-cloud-link tag-link-598 tag-link-position-10" style="font-size: 10.453608247423pt;" aria-label="DCSync (8 items)">DCSync</a> <a href="https://adsecurity.org/?tag=domaincontroller" class="tag-cloud-link tag-link-101 tag-link-position-11" style="font-size: 15.216494845361pt;" aria-label="DomainController (18 items)">DomainController</a> <a href="https://adsecurity.org/?tag=goldenticket" class="tag-cloud-link tag-link-303 tag-link-position-12" style="font-size: 11.175257731959pt;" aria-label="GoldenTicket (9 items)">GoldenTicket</a> <a href="https://adsecurity.org/?tag=grouppolicy" class="tag-cloud-link tag-link-196 tag-link-position-13" style="font-size: 8pt;" aria-label="GroupPolicy (5 items)">GroupPolicy</a> <a href="https://adsecurity.org/?tag=hyperv" class="tag-cloud-link tag-link-3 tag-link-position-14" style="font-size: 8pt;" aria-label="HyperV (5 items)">HyperV</a> <a href="https://adsecurity.org/?tag=invoke-mimikatz" class="tag-cloud-link tag-link-336 tag-link-position-15" style="font-size: 10.453608247423pt;" aria-label="Invoke-Mimikatz (8 items)">Invoke-Mimikatz</a> <a href="https://adsecurity.org/?tag=kb3011780" class="tag-cloud-link tag-link-337 tag-link-position-16" style="font-size: 9.7319587628866pt;" aria-label="KB3011780 (7 items)">KB3011780</a> <a href="https://adsecurity.org/?tag=kdc" class="tag-cloud-link tag-link-80 tag-link-position-17" style="font-size: 8pt;" aria-label="KDC (5 items)">KDC</a> <a href="https://adsecurity.org/?tag=kerberos" class="tag-cloud-link tag-link-81 tag-link-position-18" style="font-size: 15.216494845361pt;" aria-label="Kerberos (18 items)">Kerberos</a> <a href="https://adsecurity.org/?tag=kerberoshacking" class="tag-cloud-link tag-link-298 tag-link-position-19" style="font-size: 11.752577319588pt;" aria-label="KerberosHacking (10 items)">KerberosHacking</a> <a href="https://adsecurity.org/?tag=krbtgt" class="tag-cloud-link tag-link-394 tag-link-position-20" style="font-size: 9.7319587628866pt;" aria-label="KRBTGT (7 items)">KRBTGT</a> <a href="https://adsecurity.org/?tag=laps" class="tag-cloud-link tag-link-631 tag-link-position-21" style="font-size: 9.0103092783505pt;" aria-label="LAPS (6 items)">LAPS</a> <a href="https://adsecurity.org/?tag=lsass" class="tag-cloud-link tag-link-71 tag-link-position-22" style="font-size: 11.175257731959pt;" aria-label="LSASS (9 items)">LSASS</a> <a href="https://adsecurity.org/?tag=mcm" class="tag-cloud-link tag-link-6 tag-link-position-23" style="font-size: 14.061855670103pt;" aria-label="MCM (15 items)">MCM</a> <a href="https://adsecurity.org/?tag=microsoftemet" class="tag-cloud-link tag-link-58 tag-link-position-24" style="font-size: 11.175257731959pt;" aria-label="MicrosoftEMET (9 items)">MicrosoftEMET</a> <a href="https://adsecurity.org/?tag=microsoftwindows" class="tag-cloud-link tag-link-102 tag-link-position-25" style="font-size: 9.7319587628866pt;" aria-label="MicrosoftWindows (7 items)">MicrosoftWindows</a> <a href="https://adsecurity.org/?tag=mimikatz" class="tag-cloud-link tag-link-207 tag-link-position-26" style="font-size: 18.103092783505pt;" aria-label="mimikatz (29 items)">mimikatz</a> <a href="https://adsecurity.org/?tag=ms14068" class="tag-cloud-link tag-link-295 tag-link-position-27" style="font-size: 11.175257731959pt;" aria-label="MS14068 (9 items)">MS14068</a> <a href="https://adsecurity.org/?tag=passthehash" class="tag-cloud-link tag-link-44 tag-link-position-28" style="font-size: 9.7319587628866pt;" aria-label="PassTheHash (7 items)">PassTheHash</a> <a href="https://adsecurity.org/?tag=powershell" class="tag-cloud-link tag-link-575 tag-link-position-29" style="font-size: 18.536082474227pt;" aria-label="PowerShell (31 items)">PowerShell</a> <a href="https://adsecurity.org/?tag=powershellcode" class="tag-cloud-link tag-link-22 tag-link-position-30" style="font-size: 14.927835051546pt;" aria-label="PowerShellCode (17 items)">PowerShellCode</a> <a href="https://adsecurity.org/?tag=powershellhacking" class="tag-cloud-link tag-link-68 tag-link-position-31" style="font-size: 8pt;" aria-label="PowerShellHacking (5 items)">PowerShellHacking</a> <a href="https://adsecurity.org/?tag=powershellv5" class="tag-cloud-link tag-link-69 tag-link-position-32" style="font-size: 8pt;" aria-label="PowerShellv5 (5 items)">PowerShellv5</a> <a href="https://adsecurity.org/?tag=powersploit" class="tag-cloud-link tag-link-232 tag-link-position-33" style="font-size: 10.453608247423pt;" aria-label="PowerSploit (8 items)">PowerSploit</a> <a href="https://adsecurity.org/?tag=presentation" class="tag-cloud-link tag-link-422 tag-link-position-34" style="font-size: 9.7319587628866pt;" aria-label="Presentation (7 items)">Presentation</a> <a href="https://adsecurity.org/?tag=security" class="tag-cloud-link tag-link-576 tag-link-position-35" style="font-size: 8pt;" aria-label="Security (5 items)">Security</a> <a href="https://adsecurity.org/?tag=silverticket" class="tag-cloud-link tag-link-304 tag-link-position-36" style="font-size: 11.175257731959pt;" aria-label="SilverTicket (9 items)">SilverTicket</a> <a href="https://adsecurity.org/?tag=sneakyadpersistence" class="tag-cloud-link tag-link-596 tag-link-position-37" style="font-size: 9.0103092783505pt;" aria-label="SneakyADPersistence (6 items)">SneakyADPersistence</a> <a href="https://adsecurity.org/?tag=spn" class="tag-cloud-link tag-link-294 tag-link-position-38" style="font-size: 9.0103092783505pt;" aria-label="SPN (6 items)">SPN</a> <a href="https://adsecurity.org/?tag=tgs" class="tag-cloud-link tag-link-528 tag-link-position-39" style="font-size: 9.0103092783505pt;" aria-label="TGS (6 items)">TGS</a> <a href="https://adsecurity.org/?tag=tgt" class="tag-cloud-link tag-link-529 tag-link-position-40" style="font-size: 9.0103092783505pt;" aria-label="TGT (6 items)">TGT</a> <a href="https://adsecurity.org/?tag=windows7" class="tag-cloud-link tag-link-117 tag-link-position-41" style="font-size: 8pt;" aria-label="Windows7 (5 items)">Windows7</a> <a href="https://adsecurity.org/?tag=windows10" class="tag-cloud-link tag-link-494 tag-link-position-42" style="font-size: 10.453608247423pt;" aria-label="Windows10 (8 items)">Windows10</a> <a href="https://adsecurity.org/?tag=windowsserver2008r2" class="tag-cloud-link tag-link-46 tag-link-position-43" style="font-size: 9.0103092783505pt;" aria-label="WindowsServer2008R2 (6 items)">WindowsServer2008R2</a> <a href="https://adsecurity.org/?tag=windowsserver2012" class="tag-cloud-link tag-link-47 tag-link-position-44" style="font-size: 11.175257731959pt;" aria-label="WindowsServer2012 (9 items)">WindowsServer2012</a> <a href="https://adsecurity.org/?tag=windowsserver2012r2" class="tag-cloud-link tag-link-54 tag-link-position-45" style="font-size: 9.7319587628866pt;" aria-label="WindowsServer2012R2 (7 items)">WindowsServer2012R2</a></div> </div><div id="search-2" class="sidebar-wrap widget_search"><form class="searchform" method="get" action="https://adsecurity.org"> <div class="input-group"> <div class="form-group live-search-input"> <label for="s" class="screen-reader-text">Search for:</label> <input type="text" id="s" name="s" class="form-control" placeholder="Search"> </div> <button class="btn btn-default" type="submit"></button> </div> </form></div> <div id="recent-posts-2" class="sidebar-wrap widget_recent_entries"> <h3>Recent Posts</h3> <ul> <li> <a href="https://adsecurity.org/?p=4436">BSides Dublin – The Current State of Microsoft Identity Security: Common Security Issues and Misconfigurations – Sean Metcalf</a> </li> <li> <a href="https://adsecurity.org/?p=4434">DEFCON 2017: Transcript – Hacking the Cloud</a> </li> <li> <a href="https://adsecurity.org/?p=4432">Detecting the Elusive: Active Directory Threat Hunting</a> </li> <li> <a href="https://adsecurity.org/?p=4430">Detecting Kerberoasting Activity</a> </li> <li> <a href="https://adsecurity.org/?p=4428">Detecting Password Spraying with Security Event Auditing</a> </li> </ul> </div><div id="recent-comments-2" class="sidebar-wrap widget_recent_comments"><h3>Recent Comments</h3><ul id="recentcomments"><li class="recentcomments">Derek on <a href="https://adsecurity.org/?p=3592#comment-13603">Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory</a></li><li class="recentcomments"><a href="https://ADSecurity.org" class="url" rel="ugc">Sean Metcalf</a> on <a href="https://adsecurity.org/?p=3782#comment-13545">Securing Microsoft Active Directory Federation Server (ADFS)</a></li><li class="recentcomments">Brad on <a href="https://adsecurity.org/?p=3782#comment-13544">Securing Microsoft Active Directory Federation Server (ADFS)</a></li><li class="recentcomments">Joonas on <a href="https://adsecurity.org/?p=3719#comment-13229">Gathering AD Data with the Active Directory PowerShell Module</a></li><li class="recentcomments"><a href="https://ADSecurity.org" class="url" rel="ugc">Sean Metcalf</a> on <a href="https://adsecurity.org/?p=3719#comment-13215">Gathering AD Data with the Active Directory PowerShell Module</a></li></ul></div><div id="archives-2" class="sidebar-wrap widget_archive"><h3>Archives</h3> <ul> <li><a href='https://adsecurity.org/?m=202406'>June 2024</a></li> <li><a href='https://adsecurity.org/?m=202405'>May 2024</a></li> <li><a href='https://adsecurity.org/?m=202005'>May 2020</a></li> <li><a href='https://adsecurity.org/?m=202001'>January 2020</a></li> <li><a href='https://adsecurity.org/?m=201908'>August 2019</a></li> <li><a href='https://adsecurity.org/?m=201903'>March 2019</a></li> <li><a href='https://adsecurity.org/?m=201902'>February 2019</a></li> <li><a href='https://adsecurity.org/?m=201810'>October 2018</a></li> <li><a href='https://adsecurity.org/?m=201808'>August 2018</a></li> <li><a href='https://adsecurity.org/?m=201805'>May 2018</a></li> <li><a href='https://adsecurity.org/?m=201801'>January 2018</a></li> <li><a href='https://adsecurity.org/?m=201711'>November 2017</a></li> <li><a href='https://adsecurity.org/?m=201708'>August 2017</a></li> <li><a href='https://adsecurity.org/?m=201706'>June 2017</a></li> <li><a href='https://adsecurity.org/?m=201705'>May 2017</a></li> <li><a href='https://adsecurity.org/?m=201702'>February 2017</a></li> <li><a href='https://adsecurity.org/?m=201701'>January 2017</a></li> <li><a href='https://adsecurity.org/?m=201611'>November 2016</a></li> <li><a href='https://adsecurity.org/?m=201610'>October 2016</a></li> <li><a href='https://adsecurity.org/?m=201609'>September 2016</a></li> <li><a href='https://adsecurity.org/?m=201608'>August 2016</a></li> <li><a href='https://adsecurity.org/?m=201607'>July 2016</a></li> <li><a href='https://adsecurity.org/?m=201606'>June 2016</a></li> <li><a href='https://adsecurity.org/?m=201604'>April 2016</a></li> <li><a href='https://adsecurity.org/?m=201603'>March 2016</a></li> <li><a href='https://adsecurity.org/?m=201602'>February 2016</a></li> <li><a href='https://adsecurity.org/?m=201601'>January 2016</a></li> <li><a href='https://adsecurity.org/?m=201512'>December 2015</a></li> <li><a href='https://adsecurity.org/?m=201511'>November 2015</a></li> <li><a href='https://adsecurity.org/?m=201510'>October 2015</a></li> <li><a href='https://adsecurity.org/?m=201509'>September 2015</a></li> <li><a href='https://adsecurity.org/?m=201508'>August 2015</a></li> <li><a href='https://adsecurity.org/?m=201507'>July 2015</a></li> <li><a href='https://adsecurity.org/?m=201506'>June 2015</a></li> <li><a href='https://adsecurity.org/?m=201505'>May 2015</a></li> <li><a href='https://adsecurity.org/?m=201504'>April 2015</a></li> <li><a href='https://adsecurity.org/?m=201503'>March 2015</a></li> <li><a href='https://adsecurity.org/?m=201502'>February 2015</a></li> <li><a href='https://adsecurity.org/?m=201501'>January 2015</a></li> <li><a href='https://adsecurity.org/?m=201412'>December 2014</a></li> <li><a href='https://adsecurity.org/?m=201411'>November 2014</a></li> <li><a href='https://adsecurity.org/?m=201410'>October 2014</a></li> <li><a href='https://adsecurity.org/?m=201409'>September 2014</a></li> <li><a href='https://adsecurity.org/?m=201408'>August 2014</a></li> <li><a href='https://adsecurity.org/?m=201407'>July 2014</a></li> <li><a href='https://adsecurity.org/?m=201406'>June 2014</a></li> <li><a href='https://adsecurity.org/?m=201405'>May 2014</a></li> <li><a href='https://adsecurity.org/?m=201404'>April 2014</a></li> <li><a href='https://adsecurity.org/?m=201403'>March 2014</a></li> <li><a href='https://adsecurity.org/?m=201402'>February 2014</a></li> <li><a href='https://adsecurity.org/?m=201307'>July 2013</a></li> <li><a href='https://adsecurity.org/?m=201211'>November 2012</a></li> <li><a href='https://adsecurity.org/?m=201203'>March 2012</a></li> <li><a href='https://adsecurity.org/?m=201202'>February 2012</a></li> </ul> </div><div id="categories-2" class="sidebar-wrap widget_categories"><h3>Categories</h3> <ul> <li class="cat-item cat-item-565"><a href="https://adsecurity.org/?cat=565">ActiveDirectorySecurity</a> </li> <li class="cat-item cat-item-55"><a href="https://adsecurity.org/?cat=55">Apple Security</a> </li> <li class="cat-item cat-item-431"><a href="https://adsecurity.org/?cat=431">Cloud Security</a> </li> <li class="cat-item cat-item-17"><a href="https://adsecurity.org/?cat=17">Continuing Education</a> </li> <li class="cat-item cat-item-396"><a href="https://adsecurity.org/?cat=396">Entertainment</a> </li> <li class="cat-item cat-item-347"><a href="https://adsecurity.org/?cat=347">Exploit</a> </li> <li class="cat-item cat-item-1039"><a href="https://adsecurity.org/?cat=1039">Hacking</a> </li> <li class="cat-item cat-item-168"><a href="https://adsecurity.org/?cat=168">Hardware Security</a> </li> <li class="cat-item cat-item-172"><a href="https://adsecurity.org/?cat=172">Hypervisor Security</a> </li> <li class="cat-item cat-item-126"><a href="https://adsecurity.org/?cat=126">Linux/Unix Security</a> </li> <li class="cat-item cat-item-343"><a href="https://adsecurity.org/?cat=343">Malware</a> </li> <li class="cat-item cat-item-11"><a href="https://adsecurity.org/?cat=11">Microsoft Security</a> </li> <li class="cat-item cat-item-819"><a href="https://adsecurity.org/?cat=819">Mitigation</a> </li> <li class="cat-item cat-item-48"><a href="https://adsecurity.org/?cat=48">Network/System Security</a> </li> <li class="cat-item cat-item-7"><a href="https://adsecurity.org/?cat=7">PowerShell</a> </li> <li class="cat-item cat-item-698"><a href="https://adsecurity.org/?cat=698">RealWorld</a> </li> <li class="cat-item cat-item-21"><a href="https://adsecurity.org/?cat=21">Security</a> </li> <li class="cat-item cat-item-234"><a href="https://adsecurity.org/?cat=234">Security Conference Presentation/Video</a> </li> <li class="cat-item cat-item-1045"><a href="https://adsecurity.org/?cat=1045">Security Recommendation</a> </li> <li class="cat-item cat-item-24"><a href="https://adsecurity.org/?cat=24">Technical Article</a> </li> <li class="cat-item cat-item-4"><a href="https://adsecurity.org/?cat=4">Technical Reading</a> </li> <li class="cat-item cat-item-2"><a href="https://adsecurity.org/?cat=2">Technical Reference</a> </li> <li class="cat-item cat-item-156"><a href="https://adsecurity.org/?cat=156">TheCloud</a> </li> <li class="cat-item cat-item-930"><a href="https://adsecurity.org/?cat=930">Vulnerability</a> </li> </ul> </div><div id="meta-2" class="sidebar-wrap widget_meta"><h3>Meta</h3> <ul> <li><a href="https://adsecurity.org/wp-login.php">Log in</a></li> <li><a href="https://adsecurity.org/?feed=rss2">Entries feed</a></li> <li><a href="https://adsecurity.org/?feed=comments-rss2">Comments feed</a></li> <li><a href="https://wordpress.org/">WordPress.org</a></li> </ul> </div> </div> </div> <div id="sidebar_bottom" class="sidebar widget-area row footer-widget-col-3"> <div id="text-2" class="sidebar-wrap widget_text col-sm-4"><h3>Copyright</h3> <div class="textwidget">Content Disclaimer: This blog and its contents are provided "AS IS" with no warranties, and they confer no rights. Script samples are provided for informational purposes only and no guarantee is provided as to functionality or suitability. The views shared on this blog reflect those of the authors and do not represent the views of any companies mentioned. Content Ownership: All content posted here is intellectual work and under the current law, the poster owns the copyright of the article. Terms of Use Copyright © 2011 - 2020.</div> </div> </div> <div id="footer" class="row default-footer"> <div class="copyright-developer"> <div id="copyright"> Content Disclaimer: This blog and its contents are provided "AS IS" with no warranties, and they confer no rights. Script samples are provided for informational purposes only and no guarantee is provided as to functionality or suitability. The views shared on this blog reflect those of the authors and do not represent the views of any companies mentioned. </div> <div id="developer"> Made with by <a href="https://www.graphene-theme.com/" rel="nofollow">Graphene Themes</a>. </div> </div> </div> </div>  <script>  </script> <script type="text/javascript" src="https://secure.statcounter.com/counter/counter.js" async></script> <noscript><div class="statcounter"><a title="web analytics" href="https://statcounter.com/"><img class="statcounter" src="https://c.statcounter.com/10100711/0/4b306538/1/" alt="web analytics" /></a></div></noscript>  <a href="#" id="back-to-top" title="Back to top"></a> <script type="text/javascript" id="tptn_tracker-js-extra"> /* <![CDATA[ */ var ajax_tptn_tracker = {"ajax_url":"https:\/\/adsecurity.org\/wp-admin\/admin-ajax.php","top_ten_id":"2535","top_ten_blog_id":"1","activate_counter":"11","top_ten_debug":"0","tptn_rnd":"916353789"}; /* ]]> */ </script> <script type="text/javascript" src="https://adsecurity.org/wp-content/plugins/top-10/includes/js/top-10-tracker.min.js?ver=1.0" id="tptn_tracker-js"></script> <script defer type="text/javascript" src="https://adsecurity.org/wp-includes/js/comment-reply.min.js?ver=6.5.5" id="comment-reply-js" async="async" data-wp-strategy="async"></script> </body> </html>

CINXE.COM

Active Directory Recon Without Admin Rights – Active Directory Security