Managing Local Administrator Passwords with LAPS 10/14/2015 PENN STATE SECURITY CONFERENCE

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Managing Local Administrator Passwords with LAPS 10/14/2015 PENN STATE SECURITY CONFERENCE"

Transcription

1 Managing Local Administrator Passwords with LAPS 2015 PENN STATE SECURITY CONFERENCE DAN BARR SYSTEMS ADMINISTRATOR, APPLIED RESEARCH LABORATORY

2 The Shared Password Threat Shared passwords are one vector used in Pass-the-Hash attacks It only takes one compromised client to effectively compromise every system using the same local Administrator password Makes lateral movement within a trusted network trivial Even if the clear text password isn t compromised, you re still in big trouble So, how do we manage passwords on a large # of systems? And rotate them often? And control who can access them? Without spending a small fortune on additional complex infrastructure or products?

3 What is Pass-the-Hash (PtH)? (The short, short version) Credential replay attack Attacker does not need the cleartext password! Hashes can be harvested from: Memory (lsass.exe process) Local SAM database (local accounts and cached AD credentials) NTLM traffic sniffing (but requires brute-force since hash is encrypted over the wire) NTLM and Kerberos (via ticket replay/forwarding) are both vulnerable Compromised Client Admin Client Clients Servers Databases Attacker

4 More on PtH For more in-depth information and a demo of Pass-the-Hash: Security Features of OneForest Active Directory Deployment Keith Brautigam & Jake DeSantis Thursday at 2:50pm

5 What is LAPS? Local Administrator Password Solution Free tool made public by Microsoft in May 2015 Formerly only available to MS Premier Support agreement holders Securely manages unique, random local Administrator passwords on managed systems Completely implemented using AD & Group Policy, no additional infrastructure needed Developed due to frequency of shared admin passwords used as a primary attack vector in customer security incidents handled by Microsoft Does NOT eliminate PtH, just reduces the impact

6 How does it work? Schema extension adds two attributes to Computer objects: ms-mcs-admpwd: Confidential, RODC Filtered ms-mcs-admpwdexpirationtime Client-side GPO extension (DLL) installed via MSI Managed via simple GUI, PowerShell, or native AD management tools LAPS UI PowerShell Group Policy Editor AD Computer Account ms-mcs-admpwd ms-mcs-admpwdexpirationtime Group Policy Framework AdmPwd.dll Active Directory

7 LAPS Features & Requirements FEATURES Passwords stored centrally in AD Optional audit/debug logging to client s Security Event Log Define password parameters: length, complexity, age Force a password reset GUI, PowerShell, or native AD tools for management REQUIREMENTS AD: At least Server 2003 SP1 Officially-supported clients: Vista with current SP & above Server 2003 SP2 & above Unofficially works on XP

8 LAPS Process GP Refresh Check expiration timestamp in AD attribute If expired, generate new password based on configured rules Store new password in AD attribute and update expiration timestamp If successful, update local account PW

9 LAPS Security Considerations Kerberos encryption used in transit Use AD object access auditing to track password retrievals Currently only handles one account per client Does not have to be built-in Administrator Password is stored in clear text Encryption at rest would require key exchange (symmetric) or PKI (assymetric) ACLs adequately protect Maintains the solution s simplicity Compromised AD means game over anyway AD attribute is marked confidential, need one of the following permissions to read it: Full Control on computer object, OR All Extended Rights on computer object, OR Control Access on ms-mcs-admpwd attribute Not replicated to RODCs Not exposed in audit logging

10 Group Policy Settings

11 LAPS UI

12 PowerShell Module AdmPwd.PS Cmdlets: Find-AdmPwdExtendedRights Get-AdmPwdPassword Reset-AdmPwdPassword Set-AdmPwdAuditing Set-AdmPwdComputerSelfPermission Set-AdmPwdReadPasswordPermission Set-AdmPwdResetPasswordPermission Update-AdmPwdADSchema

13 Typical Deployment Workflow Extend AD Schema Review/Revoke Extended Rights Add Machine Rights (SELF) Add User Rights and Auditing Apply Group Policy Settings Deploy Client Side Extension

14 Deployment Workflow - PowerShell Extend AD Schema Update-AdmPwdADSchema Audit/remove undesired extended rights Find-AdmPwdExtendedRights -Identity <OU Name> Format-Table Add Machine rights (SELF permission to update new attributes) Set-AdmPwdComputerSelfPermission -OrgUnit <OU Name> Add User rights to read PW or force reset Set-AdmPwdReadPasswordPermission -OrgUnit <OU Name> -AllowedPrincipals <users/groups> Set-AdmPwdResetPasswordPermission -OrgUnit <OU Name> -AllowedPrincipals <users/groups> Enable access auditing Set-AdmPwdAuditing -OrgUnit <OU Name> -AuditedPrincipals <users/groups/everyone>

15 Other PtH Mitigations Upgrade clients lots of kernel-level hardening in newer (Win8+) versions. Limit client-to-client communications Disable caching of AD credentials where possible Limit use/scope of privileged accounts least user access Use hardened administrative stations & jump servers Offers fewer chances to harvest a privileged hash Limit debug privileges (often used to access memory of protected processes)

16 THANK YOU! Reminder: Security of OneForest AD Deployment, 2:30pm tomorrow Keith Brautigam & Jake DeSantis, ITS Identity Services Dan Barr

Step by Step Guide to Deploy Microsoft LAPS

Step by Step Guide to Deploy Microsoft LAPS Step by Step Guide to Deploy Microsoft LAPS In this document I will show you step by step method to deploy Microsoft LAPS. The Local Administrator Password Solution (LAPS) provides management of local

More information

Windows Attack - Gain Enterprise Admin Privileges in 5 Minutes

Windows Attack - Gain Enterprise Admin Privileges in 5 Minutes Windows Attack - Gain Enterprise Admin Privileges in 5 Minutes Compass Security AG, Daniel Stirnimann Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel +41 55-214 41 60 Fax +41

More information

MySQL Security: Best Practices

MySQL Security: Best Practices MySQL Security: Best Practices Sastry Vedantam sastry.vedantam@oracle.com Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes

More information

Pass-the-Hash. Solution Brief

Pass-the-Hash. Solution Brief Solution Brief What is Pass-the-Hash? The tools and techniques that hackers use to infiltrate an organization are constantly evolving. Credential theft is a consistent concern as compromised credentials

More information

Information Assurance Directorate

Information Assurance Directorate National Security Agency/Central Security Service Information Assurance Directorate Reducing the Effectiveness of Pass-the-Hash November 19, 2013 Revision 1 A product of the Network Components and Applications

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Number: 6425C Course Length: 5 Days Course Overview This five-day course provides in-depth training on implementing,

More information

Pass-the-Hash II: Admin s Revenge. Skip Duckwall & Chris Campbell

Pass-the-Hash II: Admin s Revenge. Skip Duckwall & Chris Campbell Pass-the-Hash II: Admin s Revenge Skip Duckwall & Chris Campbell Do you know who I am? Skip Co-presented PTH talk last year at BH, Derbycon http://passing-the-hash.blogspot.com @passingthehash on twitter

More information

6425C - Windows Server 2008 R2 Active Directory Domain Services

6425C - Windows Server 2008 R2 Active Directory Domain Services Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Introduction This five-day instructor-led course provides in-depth training on configuring Active Directory Domain Services

More information

Active Directory Comapatibility with ExtremeZ-IP A Technical Best Practices Whitepaper

Active Directory Comapatibility with ExtremeZ-IP A Technical Best Practices Whitepaper Active Directory Comapatibility with ExtremeZ-IP A Technical Best Practices Whitepaper About this Document The purpose of this technical paper is to discuss how ExtremeZ-IP supports Microsoft Active Directory.

More information

Password Power 8 Plug-In for Lotus Domino Single Sign-On via Kerberos

Password Power 8 Plug-In for Lotus Domino Single Sign-On via Kerberos Password Power 8 Plug-In for Lotus Domino Single Sign-On via Kerberos PistolStar, Inc. PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200 Fax: 603.546.2309 E-mail: salesteam@pistolstar.com Website:

More information

Microsoft. Jump Start. M11: Implementing Active Directory Domain Services

Microsoft. Jump Start. M11: Implementing Active Directory Domain Services Microsoft Jump Start M11: Implementing Active Directory Domain Services Rick Claus Technical Evangelist Microsoft Ed Liberman Technical Trainer Train Signal Jump Start Target Agenda Day One Day 1 Day 2

More information

Configuring and Troubleshooting Windows 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows 2008 Active Directory Domain Services About this Course Configuring and Troubleshooting Windows This five-day instructor-led course provides in-depth training on implementing, configuring, managing and troubleshooting Active Directory Domain

More information

Optimization in a Secure Windows Environment

Optimization in a Secure Windows Environment WHITE PAPER Optimization in a Secure Windows Environment A guide to the preparation, configuration and troubleshooting of Riverbed Steelhead appliances for Signed SMB and Encrypted MAPI September 2013

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Number: 6425A Length: 5 Day(s)

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Number: 6425A Length: 5 Day(s) Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Number: 6425A Length: 5 Day(s) Certification Exam This course is preparation for the following exam: Exam 70-640:

More information

Exam 70-411: Administrating Windows Server 2012 R2. Course Overview

Exam 70-411: Administrating Windows Server 2012 R2. Course Overview Exam 70-411: Administrating Windows Server 2012 R2 Course Overview This course teaches students server deployment and image management, managing servers and updates, file and print services, configuring

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Active Directory About this Course This five-day instructor-led course provides in-depth training on implementing, configuring, managing and troubleshooting (AD DS) in and R2 environments. It covers core

More information

Getting a handle on SharePoint security complexity

Getting a handle on SharePoint security complexity 28.11.2013 Alexios Fakos Principal Security Consultant Jan Philipp Solution Consultant Security Getting a handle on SharePoint security complexity Introduction» Who we are Purpose today» Why this topic:

More information

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Length: 5 Days Published: June 02, 2011 Language(s): English Audience(s): IT Professionals Level: 200

More information

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Five Days, Instructor-Led About this course This five-day instructor-led course provides in-depth training

More information

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services www.etidaho.com (208) 327-0768 Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services 5 Days About this Course This five-day instructor-led course provides in-depth

More information

Active Directory Compatibility with ExtremeZ-IP

Active Directory Compatibility with ExtremeZ-IP Active Directory Compatibility with ExtremeZ-IP A Technical Best Practices White Paper Group Logic White Paper October 2010 About This Document The purpose of this technical paper is to discuss how ExtremeZ-IP

More information

Microsoft Corporation. Status: Preliminary documentation

Microsoft Corporation. Status: Preliminary documentation Microsoft Corporation Status: Preliminary documentation Beta content: This guide is currently in beta form. The AppLocker team greatly appreciates you reviewing the document and looks forward to receiving

More information

NE-6425C Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

NE-6425C Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services NE-6425C Configuring and Troubleshooting Windows Server 2008 Active Domain Services Summary Duration Vendor Audience 5 Days Microsoft IT Professionals Published Level Technology 02 June 2011 200 Windows

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Details Course Outline Module 1: Introducing Active Directory Domain Services This module provides

More information

ExecuTrain Course Outline Configuring & Troubleshooting Windows Server 2008 Active Directory Domain Services MOC 6425C 5 Days

ExecuTrain Course Outline Configuring & Troubleshooting Windows Server 2008 Active Directory Domain Services MOC 6425C 5 Days ExecuTrain Course Outline Configuring & Troubleshooting Windows Server 2008 Active Directory Domain Services MOC 6425C 5 Days Introduction This five-day instructor-led course provides in-depth training

More information

MS-6425C - Configuring Windows Server 2008 Active Directory Domain Services

MS-6425C - Configuring Windows Server 2008 Active Directory Domain Services MS-6425C - Configuring Windows Server 2008 Active Directory Domain Services Table of Contents Introduction Audience At Clinic Completion Prerequisites Microsoft Certified Professional Exams Student Materials

More information

Secret Server Qualys Integration Guide

Secret Server Qualys Integration Guide Secret Server Qualys Integration Guide Table of Contents Secret Server and Qualys Cloud Platform... 2 Authenticated vs. Unauthenticated Scanning... 2 What are the Advantages?... 2 Integrating Secret Server

More information

Understanding and evaluating risk to information assets in your software projects

Understanding and evaluating risk to information assets in your software projects Understanding and evaluating risk to information assets in your software projects ugh.. what a mouthful Dana Epp Windows Security MVP Who am I? Microsoft Windows Security MVP Information Security Professional

More information

6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services 6425C: Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Details Course Code: Duration: Notes: 6425C 5 days This course syllabus should be used to determine whether

More information

70 299 Implementing and Administering Security in a Microsoft Windows Server 2003 Network

70 299 Implementing and Administering Security in a Microsoft Windows Server 2003 Network 70 299 Implementing and Administering Security in a Microsoft Windows Server 2003 Network Course Number: 70 299 Length: 1 Day(s) Course Overview This course is part of the MCSA training.. Prerequisites

More information

MS 50255B: Managing Windows Environments with Group Policy (4 Days)

MS 50255B: Managing Windows Environments with Group Policy (4 Days) www.peaklearningllc.com MS 50255B: Managing Windows Environments with Group Policy (4 Days) Introduction In course you will learn how to reduce costs and increase efficiencies in your network. You will

More information

Active Directory Compatibility with ExtremeZ-IP. A Technical Best Practices Whitepaper

Active Directory Compatibility with ExtremeZ-IP. A Technical Best Practices Whitepaper Active Directory Compatibility with ExtremeZ-IP A Technical Best Practices Whitepaper About this Document The purpose of this technical paper is to discuss how ExtremeZ-IP supports Microsoft Active Directory.

More information

Managing and Maintaining Windows Server 2008 Active Directory Servers

Managing and Maintaining Windows Server 2008 Active Directory Servers Managing and Maintaining Windows Server 2008 Active Directory Servers Course Number: 6432A Course Length: 2 Days Course Overview This two-day instructor-led course provides students with the knowledge

More information

Table of Contents. Table of Contents... 2. 1 Installation overview... 3. 2 Create a Group Policy Object and Deploy SmartAgentSetup MSI package...

Table of Contents. Table of Contents... 2. 1 Installation overview... 3. 2 Create a Group Policy Object and Deploy SmartAgentSetup MSI package... 1 Table of Contents Table of Contents... 2 1 Installation overview... 3 2 Create a Group Policy Object and Deploy SmartAgentSetup MSI package... 4 3 Change SmartAgentSetup Settings (Redeploy)... 11 4 Predefine

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Duration: 5 days About this Course: This five-day instructor-led course provides in-depth training on implementing, configuring, managing and troubleshooting Active Directory Domain Services (AD

More information

Updating your Network Infrastructure and Active Directory Technology Skills to Windows Server 2008

Updating your Network Infrastructure and Active Directory Technology Skills to Windows Server 2008 Updating your Network Infrastructure and Active Directory Technology Skills to Windows Introduction This five day instructor led course provides students with the knowledge and skills to work with Network

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services 6425 - Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Duration: 5 days Course Price: $2,975 Software Assurance Eligible Course Description Microsoft Windows Server

More information

Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government

Department of Information Technology Active Directory Audit Final Report. August 2008. promoting efficient & effective local government Department of Information Technology Active Directory Audit Final Report August 2008 promoting efficient & effective local government Executive Summary Active Directory (AD) is a directory service by Microsoft

More information

Preliminary Course Syllabus

Preliminary Course Syllabus Preliminary Course Syllabus Designing Security for Microsoft SQL Server 2005 Elements of this syllabus are subject to change. Key Data Product #: 1917 Course #: 2787A Number of Days: 2 Format: Instructor-Led

More information

Designing Security for Microsoft SQL Server 2005

Designing Security for Microsoft SQL Server 2005 Designing Security for Microsoft SQL Server 2005 Course 2787 Two Days Hands-On, Instructor-Led Introduction This two-day instructor-led course enables database administrators who work with enterprise environments

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Code: M6425 Vendor: Microsoft Course Overview Duration: 5 RRP: 2,025 Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Overview This five-day instructor-led course

More information

Defense Security Service Office of the Designated Approving Authority Standardization of Baseline Technical Security Configurations

Defense Security Service Office of the Designated Approving Authority Standardization of Baseline Technical Security Configurations Defense Security Service Office of the Designated Approving Authority Standardization of Baseline Technical Security Configurations March 2009 Version 2.2 This page intentionally left blank. 2 1. Introduction...4

More information

Contents 1. Introduction 2. Security Considerations 3. Installation 4. Configuration 5. Uninstallation 6. Automated Bulk Enrollment 7.

Contents 1. Introduction 2. Security Considerations 3. Installation 4. Configuration 5. Uninstallation 6. Automated Bulk Enrollment 7. Contents 1. Introduction 2. Security Considerations 3. Installation 4. Configuration 5. Uninstallation 6. Automated Bulk Enrollment 7. Troubleshooting Introduction Adaxes Self-Service Client provides secure

More information

Mod 2: User Management

Mod 2: User Management Office 365 for SMB Jump Start Mod 2: User Management Chris Oakman Managing Partner Infrastructure Team Eastridge Technology Stephen Hall CEO & SMB Technologist District Computers 1 Jump Start Schedule

More information

Likewise Security Benefits

Likewise Security Benefits Likewise Enterprise Likewise Security Benefits AUTHOR: Manny Vellon Chief Technology Officer Likewise Software Abstract This document describes how Likewise improves the security of Linux and UNIX computers

More information

MS-50255: Managing, Maintaining, and Securing Your Networks Through Group Policy. Course Objectives. Required Exam(s) Price.

MS-50255: Managing, Maintaining, and Securing Your Networks Through Group Policy. Course Objectives. Required Exam(s) Price. MS-50255: Managing, Maintaining, and Securing Your Networks Through Group Policy Discover how to consolidate the administration of an enterprise IT infrastructure with Group Policy. In this four-day instructor

More information

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1

Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A

More information

Privileged. Account Management. Accounts Discovery, Password Protection & Management. Overview. Privileged. Accounts Discovery

Privileged. Account Management. Accounts Discovery, Password Protection & Management. Overview. Privileged. Accounts Discovery Overview Password Manager Pro offers a complete solution to control, manage, monitor and audit the entire life-cycle of privileged access. In a single package it offers three solutions - privileged account

More information

Top 10 Security Hardening Settings for Windows Servers and Active Directory

Top 10 Security Hardening Settings for Windows Servers and Active Directory SESSION ID: CRWD-R04 Top 10 Security Hardening Settings for Windows Servers and Active Directory Derek Melber Technical Evangelist ADSolutions ManageEngine @derekmelber Agenda Traditional security hardening

More information

NetWrix Password Manager. Quick Start Guide

NetWrix Password Manager. Quick Start Guide NetWrix Password Manager Quick Start Guide Contents Overview... 3 Setup... 3 Deploying the Core Components... 3 System Requirements... 3 Installation... 4 Windows Server 2008 Notes... 4 Upgrade Path...

More information

Course 6425C: Five days

Course 6425C: Five days CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course 6425C: Five

More information

Web. Security Options Comparison

Web. Security Options Comparison Web 3 Security Options Comparison Windows Server 2003 provides a number of Security Options that can be applied within the scope of managing a GPO. Most are the same as those available in Windows 2000.

More information

MaaS360 Mobile Enterprise Gateway

MaaS360 Mobile Enterprise Gateway MaaS360 Mobile Enterprise Gateway Administrator Guide Copyright 2013 Fiberlink Communications Corporation. All rights reserved. Information in this document is subject to change without notice. The software

More information

Upgrading Identity Lifecycle Manager 2007 to Forefront Identity Manager 2010

Upgrading Identity Lifecycle Manager 2007 to Forefront Identity Manager 2010 Upgrading Identity Lifecycle Manager 2007 to Forefront Identity Manager 2010 Course M50383 4 Day(s) 24:00 Hours Introduction This four-day instructor-led course equips participants already acquainted with

More information

Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques. Mitigating the risk of lateral movement and privilege escalation

Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques. Mitigating the risk of lateral movement and privilege escalation Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques Mitigating the risk of lateral movement and privilege escalation Mitigating Pass-the-Hash (PtH) Attacks and Other Credential

More information

Pass-the-Hash: How Attackers Spread and How to Stop Them

Pass-the-Hash: How Attackers Spread and How to Stop Them Pass-the-Hash: How Attackers Spread and How to Stop Them SESSION ID: HTA-W03 Mark Russinovich Technical Fellow Microsoft Corporation Nathan Ide Principal Development Lead Microsoft Corporation Pass-the-Hash:

More information

MaaS360 Mobile Enterprise Gateway

MaaS360 Mobile Enterprise Gateway MaaS360 Mobile Enterprise Gateway Administrator Guide Copyright 2014 Fiberlink, an IBM Company. All rights reserved. Information in this document is subject to change without notice. The software described

More information

Five Steps to Improve Internal Network Security. Chattanooga ISSA

Five Steps to Improve Internal Network Security. Chattanooga ISSA Five Steps to Improve Internal Network Security Chattanooga ISSA 1 Find Me AverageSecurityGuy.info @averagesecguy stephen@averagesecurityguy.info github.com/averagesecurityguy ChattSec.org 2 Why? The methodical

More information

Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken

Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? Currently a security researcher at Synopsys, working on application security tools and Coverity s static analysis

More information

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013 CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain MOC 6425

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain MOC 6425 Configuring and Troubleshooting Windows Server 2008 Active Directory Domain MOC 6425 Course Outline Module 1: Introducing Active Directory Domain Services This module provides an overview of Active Directory

More information

Securing Active Directory Presented by Michael Ivy

Securing Active Directory Presented by Michael Ivy Securing Active Directory Presented by Michael Ivy Presenter: Michael Ivy Consultant, Rook Security Michael Ivy Thank you for being here today August 20, 2014 Brief Overview Securing NTDS and Replication

More information

Computer Security: Principles and Practice

Computer Security: Principles and Practice Computer Security: Principles and Practice Chapter 24 Windows and Windows Vista Security First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Windows and Windows Vista Security

More information

70-640 R4: Configuring Windows Server 2008 Active Directory

70-640 R4: Configuring Windows Server 2008 Active Directory 70-640 R4: Configuring Windows Server 2008 Active Directory Course Introduction Course Introduction Chapter 01 - Installing the Active Directory Role Lesson: What is IDA? What is Active Directory Identity

More information

User-ID Best Practices

User-ID Best Practices User-ID Best Practices PAN-OS 5.0, 5.1, 6.0 Revision A 2011, Palo Alto Networks, Inc. www.paloaltonetworks.com Table of Contents PAN-OS User-ID Functions... 3 User / Group Enumeration... 3 Using LDAP Servers

More information

Using Logon Agent for Transparent User Identification

Using Logon Agent for Transparent User Identification Using Logon Agent for Transparent User Identification Websense Logon Agent (also called Authentication Server) identifies users in real time, as they log on to domains. Logon Agent works with the Websense

More information

6.1.2 Installing AD DS 7:45

6.1.2 Installing AD DS 7:45 Module 6 Active Directory Module 6 discusses using Active Directory roles; using RODC to access read-only partitions of an Active Directory database, adding Certificate Services role services, managing

More information

Course Description. Course Audience. Course Outline. Course Page - Page 1 of 7

Course Description. Course Audience. Course Outline. Course Page - Page 1 of 7 Course Page - Page 1 of 7 Configuring and Managing Windows Server 2012 Active Directory BSP-AD2012 Length: 5 days Price: $ 2,795.00 Course Description This course is targeted toward information technology

More information

This module explains how to configure and troubleshoot DNS, including DNS replication and caching.

This module explains how to configure and troubleshoot DNS, including DNS replication and caching. Module 1: Configuring and Troubleshooting Domain Name System This module explains how to configure and troubleshoot DNS, including DNS replication and caching. Configuring the DNS Server Role Configuring

More information

TECHNICAL DOCUMENTATION SPECOPS DEPLOY / APP 4.7 DOCUMENTATION

TECHNICAL DOCUMENTATION SPECOPS DEPLOY / APP 4.7 DOCUMENTATION TECHNICAL DOCUMENTATION SPECOPS DEPLOY / APP 4.7 DOCUMENTATION Contents 1. Getting Started... 4 1.1 Specops Deploy Supported Configurations... 4 2. Specops Deploy and Active Directory...5 3. Specops Deploy

More information

Thick Client Application Security

Thick Client Application Security Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two

More information

Table of Contents Introduction... 2 Azure ADSync Requirements/Prerequisites:... 2 Software Requirements... 2 Hardware Requirements...

Table of Contents Introduction... 2 Azure ADSync Requirements/Prerequisites:... 2 Software Requirements... 2 Hardware Requirements... Table of Contents Introduction... 2 Azure ADSync Requirements/Prerequisites:... 2 Software Requirements... 2 Hardware Requirements... 2 Service Accounts for Azure AD Sync Tool... 3 On Premises Service

More information

Partie Serveur 2008. Lab : Implement Group Policy. Create, Edit and Link GPOs. Lab : Explore Group Policy Settings and Features

Partie Serveur 2008. Lab : Implement Group Policy. Create, Edit and Link GPOs. Lab : Explore Group Policy Settings and Features Partie Serveur 2008 Implement a Group Policy Infrastructure This module explains what Group Policy is, how it works, and how best to implement Group Policy in your organization. Understand Group Policy

More information

Admin Report Kit for Active Directory

Admin Report Kit for Active Directory Admin Report Kit for Active Directory Reporting tool for Microsoft Active Directory Enterprise Product Overview Admin Report Kit for Active Directory (ARKAD) is a powerful reporting solution for the Microsoft

More information

Configuring Windows Server 2008 Active Directory

Configuring Windows Server 2008 Active Directory Configuring Windows Server 2008 Active Directory Course Number: 70-640 Certification Exam This course is preparation for the Microsoft Technical Specialist (TS) exam, Exam 70-640: TS: Windows Server 2008

More information

Microsoft Windows PowerShell v2 For Administrators

Microsoft Windows PowerShell v2 For Administrators Course 50414B: Microsoft Windows PowerShell v2 For Administrators Course Details Course Outline Module 1: Introduction to PowerShell the Basics This module explains how to install and configure PowerShell.

More information

RSA Authentication Agents Security Best Practices Guide. Version 3

RSA Authentication Agents Security Best Practices Guide. Version 3 RSA Authentication Agents Security Best Practices Guide Version 3 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks RSA,

More information

Enhanced Security Administrative Environment. Wally Lee Cybersecurity Architect Cybersecurity Global Practice

Enhanced Security Administrative Environment. Wally Lee Cybersecurity Architect Cybersecurity Global Practice Enhanced Security Administrative Environment Wally Lee Cybersecurity Architect Cybersecurity Global Practice INTERNATIONAL HEADLINES Britain targeted by 120,000 cyber attacks every DAY Anonymous intends

More information

411-Administering Windows Server 2012

411-Administering Windows Server 2012 411-Administering Windows Server 2012 Course Duration: 5 Days Module 1: Configuring and Troubleshooting Domain Name System This module explains how to configure and troubleshoot DNS, including DNS replication

More information

Hosts HARDENING WINDOWS NETWORKS TRAINING

Hosts HARDENING WINDOWS NETWORKS TRAINING BROADVIEW NETWORKS Hosts HARDENING WINDOWS NETWORKS TRAINING COURSE OVERVIEW A hands-on security course that teaches students how to harden, monitor and protect Microsoft Windows based networks. A hardening

More information

Stealing credentials for impersonation

Stealing credentials for impersonation Stealing credentials for impersonation Emmanuel Bouillon manu@veryopenid.net October 29, 2010 Disclaimer Introduction This expresses my own views and does not involve my previous, current and future employers.

More information

Mitigating Server Breaches with Secure Computation. Yehuda Lindell Bar-Ilan University and Dyadic Security

Mitigating Server Breaches with Secure Computation. Yehuda Lindell Bar-Ilan University and Dyadic Security Mitigating Server Breaches with Secure Computation Yehuda Lindell Bar-Ilan University and Dyadic Security The Problem Network and server breaches have become ubiquitous Financially-motivated and state-sponsored

More information

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services

Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Configuring and Troubleshooting Windows Server 2008 Active Directory Domain Services Course Number: 6425B Course Length: 5 Days Course Overview This five-day course provides to teach Active Directory Technology

More information

Managing Windows Environments with Group Policy

Managing Windows Environments with Group Policy 3 Riverchase Office Plaza Hoover, Alabama 35244 Phone: 205.989.4944 Fax: 855.317.2187 E-Mail: rwhitney@discoveritt.com Web: www.discoveritt.com Managing Windows Environments with Group Policy Course: MS50255C

More information

Table of Contents. Introduction. Audience. At Course Completion

Table of Contents. Introduction. Audience. At Course Completion Table of Contents Introduction Audience At Course Completion Prerequisites Certified Professional Exams Student Materials Course Outline Introduction This four-day, instructor-led course provides students

More information

Deploying EFS: Part 1

Deploying EFS: Part 1 Security Watch Deploying EFS: Part 1 John Morello By now, everyone has heard reports about personal or sensitive data being lost because of laptop theft or misplacement. Laptops go missing on a regular

More information

Aras Innovator Authentication Setup

Aras Innovator Authentication Setup Aras Innovator Authentication Setup Aras Innovator 9.1 Document #: 9.1.009032008 Last Modified: 3/12/2009 Copyright 2009 Aras Corporation ARAS CORPORATION Copyright 2009 All rights reserved Aras Corporation

More information

70-647 Q&A. DEMO Version

70-647 Q&A. DEMO Version PRO: Windows Server 2008, Enterprise Administrator Q&A DEMO Version Copyright (c) 2011 Chinatag LLC. All rights reserved. Important Note Please Read Carefully For demonstration purpose only, this free

More information

Exam Name : Windows Server 2008,Enterprise Administrator. Version : Demo. http://cert24.com/

Exam Name : Windows Server 2008,Enterprise Administrator. Version : Demo. http://cert24.com/ Exam Number : 070-647 Exam Name : Windows Server 2008,Enterprise Administrator Version : Demo http://cert24.com/ QUESTION 1 Your company has three offices. Each office is configured as an Active Directory

More information

Windows passwords security

Windows passwords security IT Advisory Windows passwords security ADVISORY WHOAMI 2 Agenda The typical windows environment Local passwords Secure storage mechanims: Syskey & SAM File Password hashing & Cracking: LM & NTLM Into the

More information

Exploiting Transparent User Identification Systems

Exploiting Transparent User Identification Systems Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background

More information

DriveLock and Windows 7

DriveLock and Windows 7 Why alone is not enough CenterTools Software GmbH 2011 Copyright Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise

More information

Windows Server 2008/2012 Server Hardening

Windows Server 2008/2012 Server Hardening Account Policies Enforce password history 24 Maximum Password Age - 42 days Minimum Password Age 2 days Minimum password length - 8 characters Password Complexity - Enable Store Password using Reversible

More information

Leverage Active Directory with Kerberos to Eliminate HTTP Password

Leverage Active Directory with Kerberos to Eliminate HTTP Password Leverage Active Directory with Kerberos to Eliminate HTTP Password PistolStar, Inc. PO Box 1226 Amherst, NH 03031 USA Phone: 603.547.1200 Fax: 603.546.2309 E-mail: salesteam@pistolstar.com Website: www.pistolstar.com

More information

MSI Admin Tool User Guide

MSI Admin Tool User Guide MSI Admin Tool User Guide Introduction The MSI Admin Tool is a utility which allows you to pre-configure your Read&Write installation package prior to installation. The tool is primarily designed to be

More information

10 things Group Policy Preferences can do better than your current script!

10 things Group Policy Preferences can do better than your current script! 10 things Group Policy Preferences can do better than your current script! By Florian Frommherz September 5th, 2008 Table of Contents Overview... 3 Drive Mappings... 3 Energy options... 5 Folder Options...

More information

Quality Management Consultancy

Quality Management Consultancy Microsoft Active Directory Domain Objectives:- Learn what s new and what s updated in Active Directory Domain Services Install, upgrade and configure Windows Server 2012 Domain Controllers Work with the

More information

Build Your Knowledge!

Build Your Knowledge! About this Course Get hands-on instruction and practice administering, including R2, in this five-day Microsoft Official Course. This course is part two in a series of three courses that provides the skills

More information

SEC100 Secure Authentication and Data Transfer with SAP Single Sign-On. Public

SEC100 Secure Authentication and Data Transfer with SAP Single Sign-On. Public SEC100 Secure Authentication and Data Transfer with SAP Single Sign-On Public Speakers Las Vegas, Oct 19-23 Christian Cohrs, Area Product Owner Barcelona, Nov 10-12 Regine Schimmer, Product Management

More information

Dell InTrust 11.0 Best Practices Report Pack

Dell InTrust 11.0 Best Practices Report Pack Complete Product Name with Trademarks Version Dell InTrust 11.0 Best Practices Report Pack November 2014 Contents About this Document Auditing Domain Controllers Auditing Exchange Servers Auditing File

More information