Microsoft Certified Master (MCM): Active Directory. Previously AD field engineer at Microsoft. Notes from the field & the lab (@duff22b)
Joined January 2025
- Tweets146
- Following702
- Followers3.3K
- Likes187
Active Directory Things retweeted
BadSuccessor is a new AD attack primitive that abuses dMSAs, allowing an attacker who can modify or create a dMSA to escalate privileges and take over the forest.
Check out @JimSycurity's latest blog post to understand how you can mitigate risk. ghst.ly/4kXTLd9
Active Directory Things retweeted
OPINION + METHODS: ACTIVE DIRECTORY MIGRATION+ CHECKLISTS! ON PAPER!
Prepping for a cut-over is never complete ... at least it seems that way.
We have extensive migration check lists that we've built since my BackOffice Small Business Server (NT 4/4.5) days.
Yeah, things have changed, but keeping meticulous change logs/notes is particularly important to a 100% successful migration so we continue to do so.
Our checklists and their notes get scanned into a PDF file with an OCR process to make sure they are searchable.
The checklist forms are built with Excel and reside in SharePoint with versioning enabled plus a required check-out and then check-in. Our SharePoint instance has been configured to search inside .PDF files.
The migration processes are mostly in PowerShell. We use VS Code to manage that repository along with Git on-premises to keep track.
How we set up VS Code and Git:
mpecsinc.com/powershell-para…
Once our client has signed-off on the work completed they get a copy of the scanned notes so that they can see our process steps as completed. Yes, they are legible. ;-)
We tried using OneNote on a Surface Pro for keeping our checklists and writing digitized notes. But, in the end paper, pens, and pencils are always there. Plus, once scanned are the notes are permanent.
Our checklists cover:
* ADDS, DNS, DHCP, DFS-N
* Exchange
* SQL
* SharePoint
* LoBs - Apps/File/Print
* Remote Desktop Services - All Roles + UPDs
** GPO RSS Publishing
And so much more. [:-)
My Small Business Server experience is absolutely priceless. :-D
Have a great weekend everyone!
Acronyms
* ADDS = Active Directory Domain Services
* DNS = Doman Name System
* DHCP = Dynamic Host Configuration Protocol
* GPO = Group Policy Object
* UPD = Remote Desktop User Profile Disk
* LoB = Line of Business (apps/services)
* OCR = Optical Character Recognition
Active Directory Things retweeted
SharpADWS: Active Directory reconnaissance and exploitation for Red Teams meterpreter.org/sharpadws-ac…
Active Directory Things retweeted
Here is a new custom administrative template (ADMX) for editing and auditing Microsoft Defender Attack Surface Reduction (ASR) policies, without being exposed to the rule GUIDs.
github.com/MichaelGrafnetter…
Active Directory Things retweeted
Together with @pavelfor, we have created the ultimate guide and tooling for configuring host-based firewalls on #ActiveDirectory domain controllers in enterprise environments. Blocks most remote command execution and authentication coercion techniques.
firewall.dsinternals.com
ALT Configuring Windows Firewall Group Policy settings using a JSON file in Visual Studio Code with code completion. We took the infrastructure-as-code approach.
ALT Screenshot from GPO results.
ALT Screenshot from a PowerShell script showing a list of dropped packets from the event log.
Active Directory Things retweeted
Domain Password Spray from a NON Domain joined box (doesn't matter if Win or Lin) what do you use?
Active Directory Things retweeted
Active Directory: Advanced Threat Hunting - Advanced hunting for group policy settings (Default Domain Controllers Policy)!
@Microsoft @github @MITREattack @msftsecurity @MVPAward #Microsoft #Windows #mvpbuzz #coolstuff #communityrocks
👇👇👇👇
github.com/tomwechsler/Activ…
Active Directory Things retweeted
If you're LAN Manager Authentication level is less than 3, you're putting your environment at risk.
With the right circumstances an attack of this could look like this:
1. Coerce a DC
2. Capture the NetNTLMv1 hash
3. Crack the NetNTLMv1 response back into an NTLM Hash
4. Create a Kerberos Silver Ticket
With rainbow tables and modern GPU resources, this is almost a guaranteed win.
You can even follow this repo by Tim McGuffin step by step: github.com/NotMedic/NetNTLMt…
Active Directory Things retweeted
Active Directory Advanced Threat Hunting - Using PowerShell to track down the source of account lockouts and bad passwords!
@Microsoft @MSTCommunity @mvpaward #Microsoft #ActiveDirectory #mvpbuzz #coolstuff #Hunting #ADDS #Windows #WindowsServer
👇👇👇👇
github.com/tomwechsler/Activ…
Active Directory Things retweeted
GOAD Writeup - Part 14: ADCS – The Rest
Exploiting ESC 5, 7, 9, 10, 11, 13, 14, and 15 in Game of Active Directory.
mayfly277.github.io/posts/AD…
Active Directory Things retweeted
GPOddity: automating GPO attack vectors through NTLM relaying meterpreter.org/gpoddity-aut…
Active Directory Things retweeted
Privilege Escalation in Active Directory Domain Services: CVE-2025-21293 Exploit Revealed with PoC Code #PrivilegeEscalation #ActiveDirectory #CVE2025 #PoCCode #MicrosoftPatch securityonline.info/privileg…
Active Directory Things retweeted
LockoutStatus
Microsoft provides an AD account lockout tool to check the lockout status.
LockoutStatus.exe is great!
microsoft.com/en-us/download…
or
microsoft.com/en-us/download…
More:
activedirectorypro.com/accou…
Active Directory Things retweeted
New Active Directory Mindmap v2025.03! 🚀
📖 Readable version: orange-cyberdefense.github.i…
🔧 Now fully generated from markdown files—way easier to update and maintain!
💡 Got improvements? PRs welcome! 👉 github.com/Orange-Cyberdefen…
Active Directory Things retweeted
Performing AD LDAP Queries Like a Ninja - @rouge_cravate cravaterouge.com/articles/ld…
Active Directory Things retweeted
#DSInternals 5.0 is out. Supports recovery of BitLocker keys, LAPS passwords, DNS zone files, contact information, organizational structure, and OS versions from #ActiveDirectory ntds.dit files. Includes some performance improvements as well. Examples: github.com/MichaelGrafnetter…
ALT Screenshot of BitLocker recovery keys being extracted from a ntds.dit file.
ALT Screenshot of a DNS zone file being reconstructed from a ntds.dit file.
Active Directory Things retweeted
IAKerb extends the Kerberos protocol and enables a client WITHOUT DIRECT VISIBILITY TO A DOMAIN CONTROLLER to authenticate via a server that does have line-of-sight.
This proxy mechanism is useful in firewall-segmented environments or remote access scenarios.
#activedirectory
Active Directory Things retweeted
Extending Active Directory Users and Computers context menus with PowerShell
dsinternals.com/en/extending…
ALT Screenshot of a customized context menu in the Active Directory Users and Computers console
Active Directory Things retweeted
In our latest article, @croco_byte proposes an implementation of a trick discovered by James Forshaw in his research. Discover how to perform pre-authenticated Kerberos relay over HTTP with our Responder and krbrelayx pull requests!
synacktiv.com/publications/a…
Active Directory Things retweeted
Big change at #PingCastle !
The release cycle is changing from "every 6 months" to a "new features" based cycle.
No more rush to issue a release with limited tests just to stick to the schedule.
See below for the full message, available at github.com/netwrix/pingcastl…
