Category: Active Directory

  • AAD-DS + KCD-PT + Federation (or how to avoid passwords on the cloud)

    New (and only available within Azure) are the Azure Active Directory Domain Services. This service is based on Azure Active Directory and the data replicated into it. It provides Domain Services as a service to subscription administrators and can be very useful for many scenario’s where domain services are required, but security or management of…

  • ImmutableID – mS-DS-ConsistencyGuid – ADConnect

    The good thing about new software is that bugs and ‘features’ are removed.. the bad is that sometimes what ever you have blogged about makes either no sense, or even worse it only applies half to it from that point on. So as AADSync was replaced by AD Connect, I got emails about the configuration…

  • ADFS on Azure

    Azure Active Directory and thus any relying party on that service (such as Office 365) has two different modes for (your) custom domains that are added to it. Managed and Federated. Managed means that the authentication happens against the Azure Active Directory. The password (-hashes) of the user accounts are in Azure AD and no…

  • ImmutableID – mS-DS-ConsistencyGuid – AADSync

    Paul Williams talked in his blog about using another attribute from on-premises Ad’s to act as the ImmutableID for Azure Active Directory (http://blog.msresource.net/2014/03/10/windows-azure-active-directory-connector-part-3-immutable-id/) While making a very detailed blog entry on why and which attribute to choose, there wasn’t a guide on how to make this work in AADSync. [update 21-Aug-2017: The latest version of…

  • Pass the Hash

    When you create a new forest or new domain, you use the Domain Admin credentials. Through the use of the “Administrator” account you can control each and every workstation and server. You can install Exchange, System Center products and much much more. But Microsoft is probably thinking twice now about the framework they have chosen…

  • Web Application Proxy – on Azure

    The Azure AD Application Proxy is a new feature available in Azure WAAD Premium. It allows administrators to securely publish internal websites using Azure’s technology. By using this, it will allow customers to make use of enterprise class hardware in their reverse proxy solutions protecting against DDOS attacks and many more other things. In this post we…

  • Mitigating attacks on your Active Directory network

    Microsoft released a new whitepaper this week that gives an insight in why you should protect your privileged accounts. One of the techniques described is the PassTheHash attack which is a sophisticated attack but fairly easy to execute. These attacks have been seen in the “field” and are being used today. If you work with…

  • Back to the future…

    Did your AD jump back to the year 2000 during the past weekend? .. This could have happened if you are syncing your time with the USNO.NAVY.MIL, as they apparently had a disruption on the 19th. see http://tycho.usno.navy.mil/ntp.html   But if time jumped back on your AD, you’re in trouble.. and the way to get…

  • Import/Export Active Directory data…

    I was trying to get a test environment up and running that should reflect the production environment of my customer (off course at the customers site.. secured and all).. one task was to duplicate the OU structure, group structure and user information (without passwords). Browsing through the web I found a VBS script that can…

  • Windows 2008R2 features part VI: Managed Service Accounts – delegation

    In a previous entry I’ve explained how you can run services under the new Managed  Service Account. Say now that we want to use this service account in combination with Kerberos and the account needs to be trusted for delegation. We set an SPN to it, but in the Active Directory Users and Computers, we…

  • Cross Forest Authentication NTLM

    So we’ve seen how a trust is setup, and how we can manipulate the domain controllers involved, can we do the same for authentication traffic? The answer would be yes, but why is it a yes, and how is the main question. While many believe WINS or LMHOSTS can help us on external (non-forest) trusts,…

  • Creating trusts (as follow up to…)

    So I was wondering the following, how do all the domain controllers know that the trust is established, since (see previous post) we cannot accurately say which domain controller is being used.. When we have the same problem with user passwords, the PDC gives the vote whether the password (just changed) for the user is valid. The…