22,494 reputation
6 3

Greg Askew

Good write-up of the various methods used by your adversaries to compromise Active Directory security:


If you are using Windows 7/2008 R2, KB2871997 should be installed to ensure that Windows credentials are removed upon logoff. Without this hotfix, administrator credentials remain in memory until the computer is restarted, which significantly elevates the risk of pass-the-hash attacks.

Additionally, WDigest credentials are enabled by default in Windows 7/2008 R2, which results in plain text credentials being stored in memory. (WDigest credentials are disabled by default in Windows 8.1\2012 R2 and later). This should be disabled using the registry fix in the article:


Good overview of the new Isolated User Mode feature of Windows 10/Server 2016 and how that can protect against pass-the-hash attacks:


AD Security definitive reference:


Enterprise Administrator at one of the largest Microsoft Active Directory installations in the world. In addition to most things Microsoft and Windows, I also maintain IIS/SQL Servers and write code for managing the infrastructure of the organization.

Top Tags (1)

Score 0
Posts 1
Posts % 100

Top Posts (1) All Questions Answers | Votes Newest

Badges (9)

Silver 6


Bronze 3