RSAT allows admins to manage Windows Server roles from a Windows client machine.
Key tools:
Active Directory Users and Computers (ADUC) – Manage users, groups, OUs.
Active Directory Sites and Services (ADSS) – Manage replication between domain controllers (DCs).
Active Directory Domains and Trusts – Manage trust relationships between domains/forests.
DNS & DHCP Management – Administer network name resolution and IP assignment.
Example: From your Windows 11 workstation, install RSAT and open ADUC to create a new user in a domain without logging onto the server itself.
Protocol to access and manage directory information (like users, groups, devices) over TCP/IP.
Default port: 389 (unencrypted), 636 (LDAPS).
Example: A web application querying AD for user authentication uses LDAP.
Kerberos relation:
Kerberos is the primary authentication protocol in AD.
LDAP can be used to query AD for users/groups, while Kerberos issues tickets for authentication.
NetBIOS (Network Basic Input/Output System): Legacy naming protocol used for LAN identification of computers.
Relation to DNS: Modern AD uses DNS to resolve domain names, but NetBIOS is still used for backward compatibility.
Example: A Windows client might first attempt NetBIOS resolution (WINS) and then fall back to DNS if not found.
A partial replica of all objects in the forest.
Stores commonly searched attributes to speed up queries.
Example: A user from Domain A searches for a user in Domain B; GC helps locate it quickly.
A DC with a read-only copy of AD database.
Ideal for branch offices with low security.
Example: Local login works, but changes must be replicated to writable DCs.
AD requires DNS for name resolution.
Domain controllers register SRV records (_ldap._tcp.dc._msdcs.domain.com).
Without DNS, clients cannot locate DCs.
Event ID 4625 – Failed login attempt
Event ID 4769 – Kerberos service ticket request
Event ID 4740 – Account lockout
Tools: SIEM (Security Information and Event Management), e.g., Splunk, to aggregate logs and alert.
Cyberattack prevention tips:
Monitor failed logins → brute force detection.
Monitor privileged account changes.
Regularly patch DCs.
Enforce strong password policies.
Trust: Logical link allowing authentication between domains/forests.
Types:
Parent-child trust – Auto-created when a child domain is added.
Tree-root trust – Between two domain trees in a forest.
External trust – Non-transitive, for domains outside the forest.
Forest trust – Transitive, between two forests.
Transitive trust: Trust extends automatically to other trusted domains.
Domain vs. Multi-Forest:
Single forest: Centralized schema, easier replication, simple trust.
Multi-forest: Isolated schemas, more complex trusts, used for mergers or security isolation.
Users from a trusted domain can access resources in another domain.
Authentication request: User → DC in own domain → DC in trusted domain → access granted if permitted.
Tool for monitoring, auditing, and reporting AD permissions.
Helps detect excessive rights or suspicious changes.
Optional: Useful for medium to large enterprises to ensure compliance and security.
A logical container of objects (users, computers, printers) within AD.
Controlled by DCs and uses common policies.
Example: corp.local is a domain with all employee accounts.
Users log in once and access multiple resources across AD without repeated authentication.
Example: Logging into Windows, then accessing SharePoint, Outlook, and Teams automatically.
Replication: DCs sync changes across the domain (intra-site vs. inter-site).
Synchronization: Ensures consistent data across DCs.
Backup: Regular system state or AD backup for recovery.
ID/account status: Monitor user enabled/disabled, locked accounts, password expiration.
Monitor Event ID 4625 → detect brute force.
Use SolarWinds ARM → audit permissions.
Backup DCs weekly → prevent data loss.
Check replication status using repadmin /replsummary.
Logical containers used to organize users, computers, and groups.
Allow delegation of control and GPO targeting.
Example:
OU=IT, OU=Employees, DC=corp, DC=local
Keyboard shortcut tip:
Win + R → dsa.msc to open AD Users & Computers directly.
Centralized configuration management for users and computers.
Applied in this order: Local → Site → Domain → OU (LSDOU).
Example:
Disable USB storage.
Enforce password complexity.
Map network drives automatically.
Key files:
SYSVOL stores GPO templates and scripts.
Security Groups: Used for permissions and access control.
Distribution Groups: Used only for email lists.
Scopes:
Domain Local
Global
Universal
Example:
Global group → added to Domain Local group → applied to a folder.
There are 5 critical AD roles:
Schema Master
Domain Naming Master
RID Master
PDC Emulator
Infrastructure Master
Why they matter:
Prevent conflicts (e.g., duplicate SIDs).
Required for password changes and time synchronization.
Command:
netdom query fsmo
Shared folder replicated across DCs.
Contains:
GPOs
Login scripts
Uses DFSR (Distributed File System Replication).
Failure symptom:
GPOs not applying to users or computers.
Blueprint defining object types and attributes.
Extending schema is irreversible.
Example: Exchange Server extends AD schema.
Security note:
Only Schema Admins can modify it.
Authentication: Who are you? (Kerberos / NTLM)
Authorization: What can you access? (ACLs, group membership)
Example:
Login succeeds, but access to a folder is denied → authorization failure.
User logs in → requests TGT (Ticket Granting Ticket)
KDC issues TGT
User requests service ticket
Access granted
Ports:
TCP/UDP 88
Attack vector:
Pass-the-Ticket
Golden Ticket
Older authentication protocol.
Less secure than Kerberos.
Vulnerable to relay attacks.
Best practice:
Disable NTLM where possible.
Used for:
Smart card logins
LDAPS
VPN authentication
Managed via Active Directory Certificate Services (AD CS).
Example:
Enforcing MFA using smart cards.
Kerberos requires clocks within 5 minutes.
PDC Emulator syncs with external time source.
Command:
w32tm /query /status
Used by applications and services.
Types:
Local Service
Network Service
Managed Service Account (MSA)
Group Managed Service Account (gMSA)
Security tip:
Never use normal user accounts for services.
Tiered admin model (Tier 0, 1, 2)
Disable legacy protocols
Least privilege
Monitor privileged group changes
Regular backups
Event IDs to watch:
4728 (group membership added)
4732 (local group changes)
AD: On-premises, LDAP, Kerberos
Azure AD (Entra ID): Cloud-based, OAuth, SAML, OpenID Connect
Hybrid identity:
AD + Azure AD Connect
States:
Created
Enabled
Disabled
Locked
Deleted
Key Event IDs:
4720 (account created)
4725 (disabled)
4740 (locked)
System State backups
Multiple DCs per domain
Test restores regularly
Worst case:
Authoritative restore
Forest recovery
Single DC only
No backups
No monitoring
NTLM still enabled
Everyone is Domain Admin
Active Directory is attacked through:
Credentials
Trusts
Misconfigurations
Legacy protocols
Key principle:
AD is not hacked; it is abused.
Common techniques:
Password dumping (LSASS memory)
Cached credentials
Keylogging
Typical tools (awareness only):
Mimikatz (credential extraction)
Defense:
Credential Guard
Disable WDigest
Enforce MFA
Event IDs:
4624 (successful logon)
4672 (special privileges assigned)
Attacker uses NTLM hash instead of password.
No cracking required.
Conditions:
NTLM enabled
Reused local admin passwords
Defense:
Disable NTLM
Use LAPS
Kerberos tickets reused or injected.
Often follows credential compromise.
Defense:
Short ticket lifetime
Monitor Kerberos event IDs
Event ID:
4769 (service ticket request anomaly)
Attacker requests service tickets.
Cracks service account passwords offline.
Targets:
Service accounts with weak passwords.
Defense:
gMSA
Long random passwords
Monitor Event ID 4769
Forged Kerberos ticket using KRBTGT account.
Full domain compromise.
Defense:
Rotate KRBTGT password twice
Monitor abnormal TGT lifetimes
This is catastrophic-level risk.
Forged service ticket.
Limited to specific service access.
Defense:
Strong service account security
Monitor service authentication patterns
Malicious LDAP queries via vulnerable apps.
Similar to SQL injection.
Defense:
Input validation
Secure LDAPS only (port 636)
Adding user to privileged groups:
Domain Admins
Enterprise Admins
Backup Operators
Event IDs:
4728
4732
Defense:
Just-in-Time (JIT) admin access
SIEM alerts
Moving from one machine to another.
Uses SMB, WMI, RDP, PsExec.
Defense:
Network segmentation
Disable local admin reuse
Firewall rules
Common mistakes:
DC used for browsing
DC hosts applications
DC has internet access
Rule:
DCs should do only AD & DNS.
Attackers create:
Hidden admin accounts
Backdoor GPOs
Scheduled tasks
Defense:
Baseline monitoring
GPO auditing
Regular AD health checks
Purpose:
Centralize logs
Correlate events
Trigger alerts
Examples:
Splunk
Sentinel
Critical AD logs:
Authentication
Privilege changes
GPO modifications
Tier 0:
Domain Controllers
Enterprise Admins
Tier 1:
Servers
Tier 2:
Workstations
Rule:
Never log Tier 0 creds into Tier 2 systems.
Hardened admin machines.
Used only for AD administration.
Defense value:
Reduces credential theft risk.
Randomizes local admin passwords.
Stored securely in AD.
Prevents:
Lateral movement
Pass-the-Hash
Prevent brute-force attacks.
Example:
5 attempts
15-minute lockout
Monitor:
Event ID 4740
Attackers:
Modify startup scripts
Deploy malicious tasks
Defense:
GPO change auditing
Restrict GPO editors
Attack scenario:
Ransomware deletes AD objects.
Defense:
Offline backups
Immutable storage
Regular restore testing
Principles:
Never trust
Always verify
Least privilege
Applied to AD:
MFA everywhere
Conditional access
Continuous monitoring
Examples:
Microsoft Defender for Identity
PingCastle
BloodHound (analysis)
Purpose:
Identify attack paths
Reduce exposure
Maps:
User → group → computer → admin paths.
Used by:
Attackers and defenders.
Defense:
Remove unnecessary privilege chains.
Everyone = Full Control
Password never expires
Legacy protocols enabled
Shared admin accounts
Phishing
Credential theft
Lateral movement
Privilege escalation
Persistence
Domain dominance
Goal:
One forest
Two domains (parent + child)
DNS integrated
Trusts auto-created
One client machine
Minimal setup:
DC1 – Forest Root Domain Controller + DNS
DC2 – Child Domain Controller + DNS
CLIENT1 – Windows workstation joined to domain
Windows 10/11 Pro or Enterprise (Hyper-V required)
16 GB RAM minimum (8 GB workable but painful)
Virtualization enabled in BIOS
Enable Hyper-V:
Win + R → optionalfeatures
Enable Hyper-V Platform and Management Tools
Create 3 VMs:
DC1
Windows Server 2022
2 CPU / 4 GB RAM
Static IP: 192.168.10.10
DC2
Windows Server 2022
2 CPU / 4 GB RAM
Static IP: 192.168.10.20
CLIENT1
Windows 11 Pro
DHCP or Static: 192.168.10.50
Networking:
Internal Virtual Switch only (isolated lab)
On DC1:
IP: 192.168.10.10
DNS: 127.0.0.1
Verify:
ipconfig /all
Common mistake:
Using public DNS (8.8.8.8) → AD WILL BREAK
Server Manager →
Add Roles
Active Directory Domain Services
DNS Server
Promote to DC:
New forest
Domain name: corp.local
Reboot.
After reboot:
Check:
echo %USERDNSDOMAIN%
Open:
dsa.msc
dnsmgmt.msc
You should see:
_msdcs.corp.local
SRV records
In ADUC:
Create OUs:
IT
HR
Workstations
Create test users:
j.decelles.it
j.decelles.hr
Create groups:
IT_Admins (Global)
HR_Users (Global)
On CLIENT1:
DNS → 192.168.10.10
Join domain: corp.local
Command check:
whoami
Login with domain user.
Prepare DC2:
DNS: 192.168.10.10
Join DC2 to corp.local first.
Install AD DS + DNS.
Promote:
Add a child domain
Domain name: branch.corp.local
Reboot.
Trust created automatically:
Parent ↔ Child
Two-way
Transitive
Verify:
Active Directory Domains and Trusts
Properties → Trusts tab
By default:
First DC is GC
Verify:
dssite.msc
NTDS Settings → Global Catalog checked
Why it matters:
Cross-domain logons
Universal group membership
From CLIENT1:
nslookup
set type=SRV
_ldap._tcp.dc._msdcs.corp.local
Expected:
Both DCs returned
Run on DC1:
repadmin /replsummary
Healthy state:
0 fails
Low latency
Create GPO:
Disable Control Panel
Link to:
OU = Workstations
Force update:
gpupdate /force
Verify with:
gpresult /r
Set policy:
3 attempts
10-minute lockout
Trigger failed logins.
Check Event Viewer:
Event ID 4740
Create a 4th VM:
Branch office DC
Read-only replication
Use when:
Physical security is weak
On DC1:
Windows Server Backup
System State backup
Test restore in isolated snapshot.
Disable NTLM
Enable LDAP signing
Enforce MFA (if hybrid)
Apply LAPS
From parent domain user:
Access child domain resource
From child domain user:
Access parent resource
Confirm:
Kerberos tickets issued
✔ DNS resolves DCs
✔ Users authenticate
✔ GPOs apply
✔ Replication healthy
✔ Trust works
If any fails → DNS first.
GPO GPMC Group Policy
Here are step-by-step examples for using PowerShell and Group Policy Preferences to edit the registry:
🛠 1. Editing the Registry Using PowerShell
Example Scenario
You need to modify the registry value examplevaluename under HKEY_CURRENT_USER\Software\Example and set it to "assigned value".
Steps
Open PowerShell as Administrator
Press Win + X → Select Windows PowerShell (Admin).
Navigate to the Registry Path
Use the Set-Location (alias cd) command:
Set-Location HKCU:\Software\Example
If the path doesn’t exist, create it with:
New-Item -Path HKCU:\Software\Example -Force
Set or Modify the Registry Value
Use Set-ItemProperty to set the value:
Set-ItemProperty -Path . -Name examplevaluename -Value "assigned value"
Verify the Change
Use Get-ItemProperty to check the updated value:
Get-ItemProperty -Path . -Name examplevaluename
Automating for Multiple Computers
For multiple systems, use a PowerShell script with Invoke-Command:
$Computers = @("PC1", "PC2", "PC3") # Replace with computer names
foreach ($Computer in $Computers) {
Invoke-Command -ComputerName $Computer -ScriptBlock {
Set-ItemProperty -Path HKCU:\Software\Example -Name examplevaluename -Value "assigned value"
}
}
🛠 2. Editing the Registry Using Group Policy Preferences
Scenario
You want to add or modify a registry value across multiple computers in an Active Directory environment.
Steps
Open Group Policy Management Console (GPMC)
Press Win + R → Type gpmc.msc → Press Enter.
Create or Edit a Group Policy Object (GPO)
Right-click your domain or an Organizational Unit (OU) → Create a GPO.
Name the GPO (e.g., Registry Edit Policy) → Click OK.
Navigate to Registry Preferences
Expand:
Computer Configuration or User Configuration →
Preferences → Windows Settings → Registry.
Create a New Registry Item
Right-click Registry → Select New → Registry Item.
Configure the following:
Action: Create (or Update, Replace, Delete).
Hive: Select the appropriate hive (e.g., HKEY_CURRENT_USER).
Key Path: Software\Example
Value Name: examplevaluename
Value Type: REG_SZ (String Value) or other as needed.
Value Data: assigned value.
Apply the GPO
Link the GPO to the target OU or domain.
Force GPO Update on Clients
Run the following command on the client computers or via a script:
gpupdate /force
💡 Key Notes
PowerShell: Flexible for scripting and quick automation; use for smaller-scale or remote edits.
Group Policy Preferences: Best for large-scale deployments in Active Directory environments.
Would you like to see examples for removing registry keys or combining these techniques in scripts? 🔧
From <https://chatgpt.com/c/675d8ec8-8190-8010-aecb-22540b992f97>
Here are examples for removing registry keys and combining techniques with scripts using PowerShell and Group Policy Preferences.
🛠 1. Removing Registry Keys Using PowerShell
Scenario
You need to delete the registry key examplevaluename from HKEY_CURRENT_USER\Software\Example.
Steps to Delete a Registry Key
Open PowerShell as Administrator
Press Win + X → Select Windows PowerShell (Admin).
Remove the Specific Registry Value
Use Remove-ItemProperty to delete the registry value:
Remove-ItemProperty -Path HKCU:\Software\Example -Name examplevaluename
Delete the Entire Registry Key
Use Remove-Item to delete the key and its subkeys:
Remove-Item -Path HKCU:\Software\Example -Recurse -Force
Verify the Deletion
Check that the key or value no longer exists:
Test-Path -Path HKCU:\Software\Example
If it returns False, the key has been deleted.
Automating Registry Deletion on Multiple Computers
Use Invoke-Command for remote execution:
$Computers = @("PC1", "PC2", "PC3") # Replace with target computer names
foreach ($Computer in $Computers) {
Invoke-Command -ComputerName $Computer -ScriptBlock {
# Delete specific value
Remove-ItemProperty -Path HKCU:\Software\Example -Name examplevaluename -ErrorAction SilentlyContinue
# Delete entire registry key
Remove-Item -Path HKCU:\Software\Example -Recurse -Force -ErrorAction SilentlyContinue
}
}
-ErrorAction SilentlyContinue prevents errors if the key doesn’t exist.
🛠 2. Removing Registry Keys Using Group Policy Preferences
Scenario
You want to delete a specific registry key or value across multiple domain-joined computers using Group Policy Preferences.
Steps to Delete a Registry Key Using GPO
Open Group Policy Management Console (GPMC)
Press Win + R → Type gpmc.msc → Press Enter.
Edit an Existing GPO or Create a New One
Right-click on the target OU → Choose Create a GPO → Name it (e.g., Registry Cleanup Policy).
Navigate to Registry Preferences
Go to:
Computer Configuration or User Configuration →
Preferences → Windows Settings → Registry.
Create a New Registry Item to Delete Keys/Values
Right-click Registry → Select New → Registry Item.
Configure the following:
Action: Delete.
Hive: HKEY_CURRENT_USER (or other appropriate hive).
Key Path: Software\Example.
Value Name: examplevaluename (leave blank to delete the entire key).
Link the GPO
Link the GPO to the desired OU or domain.
Force GPO Update on Client Computers
Run the following command on clients:
gpupdate /force
💻 3. Combining Registry Actions in Scripts
Scenario
You want to:
Backup a registry key.
Modify a registry value.
Delete a specific registry value.
PowerShell Script
# Backup the Registry Key
Export-RegistryKey -Path HKCU:\Software\Example -Destination C:\Backup\examplebackup.reg
# Modify the Registry Value
New-Item -Path HKCU:\Software\Example -Force
Set-ItemProperty -Path HKCU:\Software\Example -Name examplevaluename -Value "NewValue"
# Delete the Specific Value
Remove-ItemProperty -Path HKCU:\Software\Example -Name examplevaluename -ErrorAction SilentlyContinue
# Verify Key Exists
if (-not (Test-Path -Path HKCU:\Software\Example)) {
Write-Host "Registry Key Deleted Successfully"
} else {
Write-Host "Registry Key Still Exists"
}
Explanation:
Backup: Exports the registry key to a file.
Modify: Creates or updates the registry value.
Delete: Removes the specific registry value.
Verify: Confirms the deletion.
🔄 Useful Notes
Backup First: Always export the registry before modifying or deleting it. Use:
reg export HKCU\Software\Example C:\Backup\examplebackup.reg
Testing: Use test machines or small pilot groups before deploying registry edits widely.
Error Handling: Add -ErrorAction SilentlyContinue to suppress unnecessary errors.
Would you like a PowerShell script template to handle these actions dynamically based on input? 🚀
From <https://chatgpt.com/c/675d8ec8-8190-8010-aecb-22540b992f97>
Group Policy Preferences
You can create, update, replace, and delete registry keys and values when you use Group Policy Preference in the domain GPO. This approach is very effective if you need to manage registry updates on many computers in an Active Directory environment.