TechJam Active Directory Auditing Presenter Matt Warburton Professional Services

TechJam Active Directory Auditing Presenter Matt Warburton Professional Services

Objectives Automate Auditing of Active Directory Review an Array of Examples Minimize Security Related Risk Address Compliance Auditing Requirements Use Available Tools/Technologies Kaseya Scripting, Documents & Logging LDAP Data Interchange Format Data Exchange (LDIFDE) Tool Comma Separated Values Data Exchange (CSVDE) Tool VBScript/Active Directory Services Interface (ADSI) Answer Questions 2

Review Examples Group Memberships Enterprise Admins, Domain Admins, All Groups User Account Control Disabled, Enabled Users, Non-Expiring Password Users Legacy/Deleted Disabled Computers, Old Computers, Deleted Objects Logon Information User Last Logon Date Other Exchange Mailbox Users, Domain Trusts, Group Policy Objects 3

LDIFDE Syntax LDIFDE -? Export Specific =============== -d RootDN The root of the LDAP search (Default to Naming Context) -r Filter LDAP search filter (Default to "(objectclass=*)") -p SearchScope Search Scope (Base/OneLevel/Subtree) -l list List of attributes (comma separated) to look for in an LDAP search -o list List of attributes (comma separated) to omit from input. -g Disable Paged Search. -m Enable the SAM logic on export. -n Do not export binary values -x Include deleted objects (tombstones) LDAP Search Filters Search filter criteria can be combined using Boolean operators expressed in prefix notation as follows: (Boolean-operator(filter)(filter)(filter)...) where Boolean-operator is any one of the Boolean operators listed below. Boolean operators can be combined and nested together to form complex expressions, such as: (Boolean-operator(filter)(Boolean-operator(filter)(filter))) The Boolean operators available for use with search filters include the following: Operator Symbol Description AND & All specified filters must be true for the statement to be true. OR At least one specified filter must be true for the statement to be true. NOT! The specified filter must not be true for the expression to be true. 4

LDIFDE (Group Memberships) Enterprise Admins -f GroupMembership-Enterprise_Admins.txt -d "DC=home,DC=local" -r "(&(objectcategory=group)(name=enterprise Admins))" -l "cn,grouptype,member" Domain Admins -f GroupMembership-Domain_Admins.txt -d "DC=home,DC=local" -r "(&(objectcategory=group)(name=domain Admins))" -l "cn,grouptype,member" All Groups -f GroupMemberships-All.txt -d "DC=home,DC=local" -r "(objectclass=group)" -l "cn,grouptype,member" 5

LDIFDE (User Account Control) Disabled Users -f UserAccounts-Disabled.txt -r "(&(objectcategory=person)(objectclass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=2))" -l "dn,cn,givenname,sn,useraccountcontrol" Enabled Users -f UserAccounts-Enabled.txt -r "(&(objectcategory=person)(objectclass=user)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" -l "dn,cn,givenname,sn,useraccountcontrol" Users with Non-Expiring Passwords -f UserAccounts-NonExpiringPasswords.txt -r "(&(objectcategory=person)(objectclass=user)(useraccountcontrol:1.2.840.113556.1.4.803:=65536))" -l "dn,cn,givenname,sn,useraccountcontrol" 6

LDIFDE (Legacy/Deleted) Disabled Computers -f DisabledComputers.txt -r "(&(objectcategory=computer)(useraccountcontrol:1.2.840.113556.1.4.803:=2))" -l "dn,cn Old Computers -f OldComputers.txt -r "(&(objectcategory=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))" -l "dn,cn,whenchanged Deleted Objects -f DeletedObjects.txt -d "cn=deleted objects,dc=home,dc=local" -x l "dn,distinguishedname,samaccountname,whenchanged,lastknownparent,objectclass,isdeleted" 7

VBScript/ADSI (Logon Information) LastLogon.vbs Enumerate All AD Users Calculate Last Logon Date Export List to Delimited File Syntax: CSCRIPT.EXE LastLogon.vbs outputfilename 8

LDIFDE (Other) Exchange Mailbox Users -f ExchangeMailboxUsers.txt -r "(&(&(& (mailnickname=*) ( (&(objectcategory=person)(objectclass=user)( (homemdb=*)(msexchhomeservername=*))) ))))" -l "dn,cn,givenname,sn,mailnickname,msexchhomeservername,homemdb,mail,proxyaddresses" Trusted Domains -f TrustedDomains.txt -r "(&(objectcategory=trusteddomain)(cn=*))" Group Policy Objects -f GroupPolicies.txt -r "(objectclass=grouppolicycontainer)" 9

Resources WikiPedia LDIF http://en.wikipedia.org/wiki/ldap_data_interchange_format Microsoft LDIFDE Syntax http://support.microsoft.com/kb/237677 Computer Performance LDIFDE/CSVDE References/Examples http://www.computerperformance.co.uk/logon/csvde_ldifde.htm 10