I performed extensive research on how attackers dump credentials from LSASS and Active Directory, including pulling the Active Directory database (ntds.dit) remotely. This information is covered in two newer and greatly expanded posts: How Attackers Dump Active Directory Database Credentials Attack Methods for Gaining Domain Admin Rights in Active Directory Attackers can pull credentials …
Category: Technical Reference
Nov 04 2014
BackupExec Service Account Security FAIL
Yes. It actually says that if the BackupExec account is a member of Schema Admins, do not remove! To be fair, it starts off with this Solution which covers the rights required: From Symantec (http://www.symantec.com/business/support/index?page=content&id=TECH88242)
Nov 03 2014
Virtualization Updates to Active Directory 2012
As part of the many updates to Active Directory, one of the most interesting is virtualization safeguarding in Windows Server 2012. Active Directory Domain Controllers running Windows Server 2012 can now identify if they are virtualized and have been improperly restored or cloned (copied). Windows Server 2012 introduces a new feature called the VM Generation …
Nov 02 2014
Domain Controller Virtual Cloning
One of the best new features of Windows Server 2012 is virtual cloning. The ASKPFE blog has an excellent article covering this new feature: Tom Moser here with a post on one of the new ADDS features in Windows Server 2012; Virtual Domain Controller Cloning. Until now, cloning, snapshotting, copying, or pretty much doing anything …
Nov 01 2014
Active Directory Domain Trusts & Trust Password Management
Recently a customer asked me about Active Directory Domain Trusts and how the passwords were managed. I replied with some educated guesses based on how AD manages a variety of passwords. After stating how I thought it worked (and mentioned that I wasn’t sure), I decided to look it up. I was mostly correct. Every …
Oct 29 2014
Windows Server 2012 R2 deprecates FRS (File Replication Service)
Microsoft’s Tip of the Day has the following useful information on Domain Controller File Replication Service (FRS) depercation: FRS (File Replication Service) has been deprecated in Windows Server 2012 R2. The deprecation of FRS has been accomplished by enforcing a minimum domain functional level of Windows Server 2008. This enforcement is present only if the …
Oct 21 2014
Hyper-V How to install integration services when the virtual machine is not running
From Microsoft’s Virtualization Blog, How to install integration services when the virtual machine is not running: We’ve been talking to a lot of people about deploying integration services (integration components) lately. As it turns out, they’re pretty easy to patch offline with existing Hyper-V tools. First, why would you update integration services on a not-running …
Oct 18 2014
Windows Server 2012 R2 Features
Single post coverage of all of the major new and updated features in Windows Server 2012 R2 This covers the following technology areas: iSCSI Target Server SMB Windows Deployment Services Active Directory BitLocker DFS Replication DHCP DNS Server Failover Clustering File and Storage Services File Server Resource Manager Group Policy Hyper-V Hyper-V Network Virtualization Hyper-V …
Oct 14 2014
New & Updated Features in Windows Server 2012 R2
New & Updated Features in Windows Server 2012 R2 Expanded from: http://technet.microsoft.com/en-us/library/dn250019 What’s New for iSCSI Target Server in Windows Server 2012 R2 iSCSI Target Server enables you to network boot multiple computers from a single operating system image that is stored in a centralized location. iSCSI Target Server can boot hundreds of computers by …
Recent Comments