Top Tweets for #ActiveDirectorySecurityTips
All of the #ActiveDirectorySecurityTips I posted here are now located on https://t.co/urL5tSIkwu
https://t.co/6P826wbqX1
Limit membership in the DNSAdmins group since this group is able to "execute" DLLs on Domain Controllers (by design).
https://t.co/YnnZtLUNL6
Original research & post:
https://t.co/iUYnNzFBcm
#ActiveDirectorySecurityTips
#ActiveDirectorySecurityTips
Run this AD module cmd:
Get-ADGroupMember 'Administrators' -Recursive | % {Get-ADUser $_ -prop ServicePrincipalName} | Where {$_.ServicePrincipalName}
Investigate & remove any SPNs on 'people' accounts. Determine why service accounts are AD admins.
There's more but this is a solid start.
A couple of previous tweets on this:
https://t.co/TaKZGMCmu8
https://t.co/Ts5e0Z7Bex
#ActiveDirectorySecurityTips
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-adgroupmember 'Account Operators' -Recursive
The Account Operators group should not be used.
Custom delegate instead.
This group is a great "backdoor" priv group for attackers.
Microsoft even says don't use this group!
* Add service accounts to a group and restrict logon type via GPO (just realized I have never written about this)
https://t.co/lAlBsjCt8a
#ActiveDirectorySecurityTips
* Rotate local admin passwords using LAPS
https://t.co/BNun70tzbN
* Block local account (including RID 500) network access to systems.
https://t.co/QvqEn4M2O5
https://t.co/a3RsN6eNFY
#ActiveDirectorySecurityTips
* Ensure appropriate AD auditing
https://t.co/p9SfKQLRbv
* Review domain Administrators membership
https://t.co/K57ozJYxTA
* Review the "Default" GPOs for inappropriate rights
https://t.co/QHsV9UWmZW
* Review AD permissions
https://t.co/rY3d74ojxc
#ActiveDirectorySecurityTips
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-adgroupmember Administrators -Recursive | select DistinguishedName
Ask Why? for:
* Service accounts
* Accounts/groups from another forest
* Computer accounts (remove)
* Normal users
* Accounts with SPNs (work to remove)
* Block AD Admins from logging onto non-DA systems using GPOs
https://t.co/VWGbMbnwxB
* Add all AD Admins to the Protected Users group to provide additional protections (including Kerberos delegation attack mitigation)
https://t.co/SljsjY2jzD
#ActiveDirectorySecurityTips
On Domain Controllers, LDAP Signing & LDAP Channel Binding become mandatory security settings.
https://t.co/CNI4qMe415
Test & Enable these before Microsoft Enables by Default:
https://t.co/S6mqkjXPQt
https://t.co/0KuzV3Pkja
#ActiveDirectorySecurity #activedirectorysecuritytips
Microsoft strongly advises customers... always a warning, especially if it involves DCs and LDAP and MS announces upcoming changes
https://t.co/u1sYph9K2K
How many have #LAPS setup in your environment? The impression I get, the folks on twitter already have a leg up on most by engaging the community to do best practices, which might skew results.. oh well... #ConfigMgr #SCCM #SysAdmin #activedirectory #activedirectorysecuritytips
Must read if you are interested in securing your environment against various attacks π
#BlueTeam #activedirectorysecuritytips
#redteam #sysadmin
https://t.co/wq7rKaG5ly
Please share in this thread some defensive techniques that are relatively simple to configure/deploy that has a high success rate (low false positives).
I'll start:
* Detect Kerberoasting:
https://t.co/PbF3iJgcwJ
* Detect PW Spraying:
https://t.co/7amOcrI5Df
#BlueTeam
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-adgroupmember 'Account Operators' -Recursive
The Account Operators group should not be used.
Custom delegate instead.
This group is a great "backdoor" priv group for attackers.
Microsoft even says don't use this group!
Remember when @PyroTek3 started tweeting out components of the Trimarc Active Directory Security Assessment (#ActiveDirectorySecurityTips)?
https://t.co/JoRTICZOlG
https://t.co/PhvnUKA8us
https://t.co/ejG8dtbdKU
Pepperidge farm remembers... π
We check these & so do attackers.
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-aduser Administrator -prop PasswordLastSet,LastLogonDate,servicePrincipalName
(change name as needed)
* PW should change every year.
* If there's a SPN, get this removed ASAP.
* Account should not have a recent logon.
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-adgroupmember Administrators -Recursive | select DistinguishedName
Ask Why? for:
* Service accounts
* Accounts/groups from another forest
* Computer accounts (remove)
* Normal users
* Accounts with SPNs (work to remove)
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-aduser krbtgt -prop Created,PasswordLastSet,msDS-KeyVersionNumber
* PW should change 2x every year.
* If Created = PWLastSet, then work to change soon.
* KeyVersionNum typically identifies how many times PW changed (n-1).
#ActiveDirectorySecurityTips
Run this AD module cmd:
get-aduser Administrator -prop PasswordLastSet,LastLogonDate,servicePrincipalName
(change name as needed)
* PW should change every year.
* If there's a SPN, get this removed ASAP.
* Account should not have a recent logon.
Last Seen Hashtags on Sotwe
minichat(**************)(**) filter:videos
Seen from United States
anxiouspanda
Seen from United States
Agavefarm
Seen from United States
minichat()*************************filter:native_video
Seen from Chile
ΰΈΰΈ₯ΰΈ΄ΰΈΰΈ«ΰΈ₯ΰΈΈΰΈΰΈΰΈ§ΰΈ΄ΰΈΰΉΰΈΰΈΰΈ£ΰΉ
Seen from Thailand
rumikpopdemonhunters
Seen from Australia
somno() +filter:native_video
Seen from Netherlands
ketellistrik
Seen from Vietnam
Most Popular Users
Elon Musk 
@elonmusk
241.7M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.6M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90.1M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers