Good write-up of the various methods used by your adversaries to compromise Active Directory security:
If you are using Windows 7/2008 R2, KB2871997 should be installed to ensure that Windows credentials are removed upon logoff. Without this hotfix, administrator credentials remain in memory until the computer is restarted, which significantly elevates the risk of pass-the-hash attacks.
Additionally, WDigest credentials are enabled by default in Windows 7/2008 R2, which results in plain text credentials being stored in memory. (WDigest credentials are disabled by default in Windows 8.1\2012 R2 and later). This should be disabled using the registry fix in the article:
Good overview of the new Isolated User Mode feature of Windows 10/Server 2016 and how that can protect against pass-the-hash attacks:
AD Security definitive reference:
Enterprise Administrator at one of the largest Microsoft Active Directory installations in the world. In addition to most things Microsoft and Windows, I also maintain IIS/SQL Servers and write code for managing the infrastructure of the organization.
Top Network Posts
- 34What's the best way to see logged in users on Windows Server 2012?
- 33People think a "hidden" save file dialog box means the computer is frozen
- 18Should I still have a physical DC, even post-Server 2012?
- 18Active Directory Health Checks
- 18Domain Administrators account policy (After PCI audit)
- 17Run antivirus software on linux DNS servers. Does it make sense?
- 15Public key authentication or similar over HTTP/HTTPS?
- View more network posts →