Archive for category Active Directory
Windows 2008R2 features part VI: Managed Service Accounts – delegation
Posted by RZomerman in . All Posts, Active Directory, Kerberos on April 1st, 2010
In a previous entry I’ve explained how you can run services under the new Managed Service Account. Say now that we want to use this service account in combination with Kerberos and the account needs to be trusted for delegation. We set an SPN to it, but in the Active Directory Users and Computers, we seem to be unable to find the trusted for delegation option.. Let’s take a closer look at these accounts once they have been created, to do this we’ll be using ldp.exe
Cross Forest Authentication NTLM
Posted by RZomerman in Active Directory, Windows 2008, Windows 2008 R2 on March 26th, 2010
So we’ve seen how a trust is setup, and how we can manipulate the domain controllers involved, can we do the same for authentication traffic? The answer would be yes, but why is it a yes, and how is the main question.
While many believe WINS or LMHOSTS can help us on external (non-forest) trusts, we dive into a packet capture that has captured the opening of a fileshare on a remote forest.
For this demo, I have installed a resource server in the forestroot domain, and a RIVER client on the OCEANFLOOR domain.
Creating trusts (as follow up to…)
Posted by RZomerman in Active Directory, Windows 2008, Windows 2008 R2 on March 26th, 2010
So I was wondering the following, how do all the domain controllers know that the trust is established, since (see previous post) we cannot accurately say which domain controller is being used..
When we have the same problem with user passwords, the PDC gives the vote whether the password (just changed) for the user is valid. The same seems to apply for Trusts. When running a trace while creating the trust on a “regular” domain controller and not the PDC, we can find out how that is accomplished. For this, I have installed a domain controller called MICHDC01 which is on the (newly created) LAKES site.
Cross Forest Authentication part 2 – Creating trusts
Posted by RZomerman in . All Posts, Active Directory, Windows 2008, Windows 2008 R2 on March 26th, 2010
In part of the the forest authentication blog post, we’ve seen that a particular path is used depending on Kerberos or NTLM authentication. We’ve also seen that domain controllers rely on other domain controllers of the forest to find the right domain (and thus object in the AD). The question now is, which domain controller of the other forest is used to authenticate the user? What happens during a trust creation, do we really need the PDC emulator? Will LMHOSTS still help us, like it did in the old days?
Those questions we will answer in this series of authentication across trusts part 2, 3 etc..
FIM RC1 U3 and admin rights
Posted by RZomerman in Active Directory, Other, Windows 2008 R2 on February 18th, 2010
So I tried to install the FIM RC (u3) in a demo environment, and what a hush hush was that.. My setup was fairly easy, all (except SQL) on a single box.. offcourse reading is not my best skill, but the install went fine.. and the portal was ready for the administrator account (installed it with). It opened on the fim server without a problem, but getting it to work remotely, that was another problem..
The guide tells you to register SPN’s for the Kerberos to work if the FIM Portal and FIM service are on seperate servers, but ALSO if you want to use the FIM password reset extension.. however registering the http/servername to a service account renders the remote login useless.. you will receive an HTTP Error 401. The requested resource required used authentication.
If you where to google (or bing) on that error code the links tell you to disable Kernel Mode kerberos in IIS.. well that kinda did NOT do the trick either and although the Sharepoint site comes up then, the FIM portal dies..
Query AD for information
Posted by RZomerman in Active Directory, Scripting on September 1st, 2009
So.. been busy lately.. but here’s a new topic.. Windows 2008? R2? Kerberos? No.. it’s scripting..
I had a customer who wanted to extract information from AD by a custom application. Offcourse we could open port 389 and have them extract the info.. but perhaps it would be easier to just query the Global Catalog (if the info you want is in there)..
New Active Directory 2008 Forest Recovery Documentation
Posted by RZomerman in Active Directory, Windows 2008, Windows 2008 R2 on May 27th, 2009
So you have implemented Active Directory 2008 .. I hope you did some investigation in backup/restore and offcourse you must update your disaster recovery documentation now.. to help you on your way Microsoft has released a new whitepaper on Forest Recovery for Windows 2008… read before and while fixing your AD.. (preferably before )
http://www.microsoft.com/downloads/details.aspx?familyid=326C8A7A-DCAD-4333-9050-A6303FF3155C&displaylang=en
Administrator Lock-out?
Posted by RZomerman in . All Posts, Active Directory on April 24th, 2009
As many may have seen, the Administrator account has some special privileges. It can logon to a workstation/server when no Global Catalog is available and it can always logon. Well seems that always is not entirely true.
Just as a regular account the Administrator account gets locked when the password attempts reach the limit as defined in the Password Policy. However, a domain controller will unlock the account as soon as a valid password has been entered. (see Jorge’s blog) That way, you can never lock yourself out of the system. However, since also most malware makers know that, they can keep trying the admin password without waiting for the lockout duration time to expire. So sometimes (actually perhaps always) you want to make sure your Administrator account is locked for a certain time period when too many passwords have been attempted.
You can disable the auto lockout reset by setting the pwd-property attribute to value 8 or 9 (9 being disabled but require strong password). Go to Adsi Edit, right click the domain and set the pwd-property to 8 or 9 (depending on if you want complex passwords).
See more on: http://msdn.microsoft.com/en-us/library/ms679431(VS.85).aspx
(Thanks to Ned Pyle)
While conflicker is on the loose, many administrators see passwords dictionary attacks on their domain controllers. It seems many accounts are locked out due to these attacks. That led to new insights in how lockout policies must be applied. If you have a good monitoring system that can also monitor password guessing attempts, it would be easy to filter 5 passwords within 5 minutes or 10 passwords within 5 seconds. Let that monitoring system disable/lock the account or inform staff. For more information on the effects of Conficker on the domain controller see the Directory Services blog).
Windows 2008 SystemStateBackup
Posted by RZomerman in . All Posts, Active Directory, Windows 2008, Windows 2008 R2 on March 26th, 2009
With the release of Windows 2008, the backup mechanism of Windows has also changed. No more NTBackup, but Windows backup, available to your 2008 system as a feature. Also part of that feature is the systemstate backup, you know the one that is utterly Important to restore Domain Controllers. Now the GUI will not let you perform a single systemstate backup (only full backups including everything) and backups can be stored on a network share. But let’s say we want a systemstate backup only?!
Did you install Exchange?
Posted by RZomerman in . All Posts, Active Directory, Other on March 18th, 2009
Lots of us install Exchange (what ever version) in our infrastructure.. do you know what Exchange does to your Active Directory.. make a statement order the shirt 
