October 2014 archive

PowerShell Data Types

Useful table with Powershell’s data types and descriptions: [string]  Fixed-length string of Unicode characters  [array] Array of values  [xml] Xml object  [int] 32-bit signed integer  [DateTime] Date and Time  [long] 64-bit signed integer  [decimal] 128-bit decimal value  [single]  Single-precision 32-bit floating point number  [double] Double-precision 64-bit floating point number  [char] A Unicode 16-bit character  [byte] …

Continue reading

BlueHat 2014 Slides: Reality Bites – The Attacker’s View of Windows Authentication and Post-exploitation

Each year, Microsoft invites security researchers (aka hackers) to speak to Microsoft employees about security issues. One of the most interesting talks listed at “BlueHat” 2014 was the one by the “Pass-the-Hash” experts, Chris Campbell, Bejamin Delpy, and Skip Duckwall. This talk will focus on the how Windows authentication works in the real world and …

Continue reading

Active Directory (and other) Security Resources

I just posted a “Security Resources” page that is a tab at the top of the site. This page contains useful security resources I have found over the years and plan on updating the content as needed. Active Directory (and other) Security Resources

Windows Server 2012 R2 deprecates FRS (File Replication Service)

Microsoft’s Tip of the Day has the following useful information on Domain Controller File Replication Service (FRS) depercation: FRS (File Replication Service) has been deprecated in Windows Server 2012 R2.  The deprecation of FRS has been accomplished by enforcing a minimum domain functional level of Windows Server 2008.  This enforcement is present only if the …

Continue reading

PowerShell Code: Convert Integer8 to Date

There are several Active Directory attributes where the value is stored as an Integer8 value. These include: accountExpires badPasswordTime lastlogon lastlogontimestamp pwdLastSet Here’s information on what Integer8 is: Many attributes in Active Directory have a data type (syntax) called Integer8. These 64-bit numbers (8 bytes) often represent time in 100-nanosecond intervals. If the Integer8 attribute …

Continue reading

Microsoft EMET 5 Configuration to Mitigate PowerPoint Zero Day

Microsoft Security Advisory 3010060: Vulnerability in Microsoft OLE Could Allow Remote Code Execution (Published: October 21, 2014) PowerPoint Zero Day Vulnerability Executive Summary: Microsoft is aware of a vulnerability affecting all supported releases of Microsoft Windows, excluding Windows Server 2003. The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft …

Continue reading

Powershell Code: Determine LastLogonTimeStamp Replication Time

It seems that I have been asked to provide a lot of user (& computer) logon information over the past few months. In order to provide this information, I (as others have) leveraged the LastLogonTimeStamp attribute to determine when a user (or computer) logged on last. Assuming you have a Windows 2003 forest mode Active …

Continue reading

Hyper-V How to install integration services when the virtual machine is not running

From Microsoft’s Virtualization Blog, How to install integration services when the virtual machine is not running: We’ve been talking to a lot of people about deploying integration services (integration components) lately.  As it turns out, they’re pretty easy to patch offline with existing Hyper-V tools. First, why would you update integration services on a not-running …

Continue reading

Windows Server 2012 R2 Features

Single post coverage of all of the major new and updated features in Windows Server 2012 R2 This covers the following technology areas: iSCSI Target Server SMB Windows Deployment Services Active Directory BitLocker DFS Replication DHCP DNS Server Failover Clustering File and Storage Services File Server Resource Manager Group Policy Hyper-V Hyper-V Network Virtualization Hyper-V …

Continue reading

PowerShell Function: Get-ADAuthGroups

Here’s a PowerShell Function that leverages Active Directory .Net to get a list of the AD authorization groups. This is extremely useful to get a complete list of security groups that comprise a user’s AD Kerberos token without having to loop or recurse AD groups.   Function GetAuthGroups { Param ( $AccountID, [switch]$CountAuthGroups, [Switch]$ReturnGroups = …

Continue reading