Microsoft Certified Master (MCM): Active Directory. Previously AD field engineer at Microsoft. Notes from the field & the lab (@duff22b)
Joined January 2025
- Tweets146
- Following702
- Followers3.3K
- Likes187
Great new article that gets into the techie detail of Active Directory domain join permissions
learn.microsoft.com/en-us/wi…
"Kerb3961", named after RFC3961, is a refactor of the Kerberos cryptography engine in its own library in Server 2025 and Win 11 24H2.
Great blog post by Will Aftring that will get you up to speed quickly: techcommunity.microsoft.com/…
Active Directory Things retweeted
BadSuccessor is a new AD attack primitive that abuses dMSAs, allowing an attacker who can modify or create a dMSA to escalate privileges and take over the forest.
Check out @JimSycurity's latest blog post to understand how you can mitigate risk. ghst.ly/4kXTLd9
Useful post for anyone tasked with reviewing the windows audit policy:
"A Data-Driven Approach to Windows Advanced Audit Policy – What to Enable and Why" by Nasreddine Bencherchali
splunk.com/en_us/blog/securi…
Microsoft have issued a 'consider disabling this service' recommendation which affects Active Directory:
"We're advising all enterprise customers who have deployed Windows Server OS (Windows Server 2016, Windows Server 2019, Windows Server 2022, and all intermediate releases therein) either as standalone machines or as part of ADDS to evaluate disabling the STS feature on those machines. This recommendation to disable STS applies even if you have never faced any prior issues with the STS feature."
learn.microsoft.com/en-us/tr…
Here's a quirky (but sensible) one to be aware of for troubleshooting in-house apps that use AD:
With AD on server 2025 the default is to only allow LDAP to add, search, and modify operations that involve confidential attributes WHEN THE CONNECTION IS ENCRYPTED.
More changes here: learn.microsoft.com/en-us/wi…
🍿20 minute video to get caught up on the server 2025 active directory security features: techcommunity.microsoft.com/…
If you need to simulate the windows domain controller locator API (DSGETDCNAME) on a client to see which DC they would be talking to, or which site they believe they are in, use nltest:
nltest /dsgetdc:yourdomain.local
We know that "ipconfig /displaydns" can be used to inspect the DNS cache on a windows client
It's especially useful for AD troubleshooting though. Example: we can understand why a client might still be talking to a DC that was moved to a new site.
You can see that this guy was looking for _ldap in Sydney but that server now resides in LA; the cached entry just hasn't expired.
If you need to pinpoint which DC made the change to an AD object/attribute you can use:
repadmin /showobjmeta dcname objectDN
It's a handy place to start; then go inspect the event logs for that DC to get more detail on whatever you're trying to find out.
AD uses "res" (reserved space) files: edbres00001.jrs & edbres00002.jrs to deliberately take space on the disk in case it unexpectantly fills up. AD can delete the res files in an emergency, free the little bit of space and safely commit transactions in flight to disk.
Active Directory Things retweeted
OPINION + METHODS: ACTIVE DIRECTORY MIGRATION+ CHECKLISTS! ON PAPER!
Prepping for a cut-over is never complete ... at least it seems that way.
We have extensive migration check lists that we've built since my BackOffice Small Business Server (NT 4/4.5) days.
Yeah, things have changed, but keeping meticulous change logs/notes is particularly important to a 100% successful migration so we continue to do so.
Our checklists and their notes get scanned into a PDF file with an OCR process to make sure they are searchable.
The checklist forms are built with Excel and reside in SharePoint with versioning enabled plus a required check-out and then check-in. Our SharePoint instance has been configured to search inside .PDF files.
The migration processes are mostly in PowerShell. We use VS Code to manage that repository along with Git on-premises to keep track.
How we set up VS Code and Git:
mpecsinc.com/powershell-para…
Once our client has signed-off on the work completed they get a copy of the scanned notes so that they can see our process steps as completed. Yes, they are legible. ;-)
We tried using OneNote on a Surface Pro for keeping our checklists and writing digitized notes. But, in the end paper, pens, and pencils are always there. Plus, once scanned are the notes are permanent.
Our checklists cover:
* ADDS, DNS, DHCP, DFS-N
* Exchange
* SQL
* SharePoint
* LoBs - Apps/File/Print
* Remote Desktop Services - All Roles + UPDs
** GPO RSS Publishing
And so much more. [:-)
My Small Business Server experience is absolutely priceless. :-D
Have a great weekend everyone!
Acronyms
* ADDS = Active Directory Domain Services
* DNS = Doman Name System
* DHCP = Dynamic Host Configuration Protocol
* GPO = Group Policy Object
* UPD = Remote Desktop User Profile Disk
* LoB = Line of Business (apps/services)
* OCR = Optical Character Recognition
The "Branch Office Deployment Guide" was gold for learning active directory.
Step by Step docs to build a complex lab and replication topology including things that you might not see in many AD environments.
Its gone now. But there is a backup here: bodg.z5.web.core.windows.net…
Active Directory Things retweeted
SharpADWS: Active Directory reconnaissance and exploitation for Red Teams meterpreter.org/sharpadws-ac…
Active Directory Things retweeted
Here is a new custom administrative template (ADMX) for editing and auditing Microsoft Defender Attack Surface Reduction (ASR) policies, without being exposed to the rule GUIDs.
github.com/MichaelGrafnetter…
Active Directory Things retweeted
Together with @pavelfor, we have created the ultimate guide and tooling for configuring host-based firewalls on #ActiveDirectory domain controllers in enterprise environments. Blocks most remote command execution and authentication coercion techniques.
firewall.dsinternals.com
ALT Configuring Windows Firewall Group Policy settings using a JSON file in Visual Studio Code with code completion. We took the infrastructure-as-code approach.
ALT Screenshot from GPO results.
ALT Screenshot from a PowerShell script showing a list of dropped packets from the event log.
