How to Add Multiple Subnets to Active Directory Sites and Services

Your infrastructure may have multiple locations and, depending on those locations, many network subnets. In some cases, you may choose to use multiple network subnets to separate services even within a single data centre.

If you are using Active Directory as the directory service in your infrastructure, you need to add these subnets to ‘Sites’ under "Active Directory Sites and Services" and ‘Subnets’ under that.

You can add subnets most simply with a few right clicks on the "Active Directory Sites and Services" console. This is usually the method that everyone uses.

This process also has an equivalent in the PowerShell world. Although it is generally not preferred by those who do not like to work with scripts, there is no better method than this when you want to do batch processing.

If you have hundreds of subnets that you need to define, you can do it in seconds with the following script.

# CSVPath
$csvFilePath = "C:\Subnet.csv"

# CSVRead
$subnets = Import-Csv -Path $csvFilePath

#Created
foreach ($subnet in $subnets) {

$name = $subnet.Name
$site = $subnet.Site
$description = $subnet.Description

try
{
New-ADReplicationSubnet -Name $name -Site $site -Description $description
Write-Host "Subnet $name added."

}catch{
Write-Host "Subnet $name failed: $_"
}
}

 

For mote detailed information ;

Have a nice day!

Netlogon Protocol Changes – News !

As you know, Microsoft Netlogon protocol change process was activated with the November 8, 2022 updates (KB5021130 – CVE-2022-38023 ).

In previous announcements, “Enforcement by Default” would be activated with the April 11, 2023 updates, but it was postponed with new announcement which is 13 June, 2023.

 

By the way after the Windows updates that are dated on or after November 8, 2022 Windows updates are installed, you can add the “RequireSeal” key below.

Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Value: RequireSeal

Data Type: REG_DWORD

Data:  0 – Disabled

 1 – Compatibility mode. Windows domain controllers will require that Netlogon clients use RPC Seal if they are running Windows, or if they are acting as either domain controllers or Trust accounts.

2 – Enforcement mode. All clients are required to use RPC Seal, unless they are added to the “Domain Controller: Allow vulnerable Netlogon secure channel connections” group policy object (GPO).

If you have more than one Domain Controller in your environment, you can distribute the registry key with the group policy method.

Or you can choose to use Powershell :

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -Name RequireSeal -Value DATA -PropertyType DWORD –Force

 

Note: Events 5838,5839 and 5840,5841 can be checked in the System Event Log on DCs with November 2022 updates installed to detect applications that may have problems.

 

 

Have a nice day!

About Domain Controller November 2022 Patch LSASS Memory Leak

As you know, Microsoft had released a possible memory leak in the “Local Security Authority Subsystem Service (LSASS.exe)” in various Windows Server versions as of November 2022 and confirming the memory leak in “Local Security Authority Subsystem Service (LSASS.exe)“.

 

The update information is as follows;

  • Windows Server 2019: Update KB5019966
  • Windows Server 2016: Update KB5019964
  • Windows Server 2012 R2: Update KB5020023, Update KB5020010
  • Windows Server 2012: Update KB5020009, Update KB5020003
  • Windows Server 2008 R2 SP1: Update KB5020000, Update KB5020013
  • Windows Server 2008 SP2: OOB-Update KB5021657

The problem can be mitigated with a workaround but issue was resolved in KB5021235.

If you used the above workaround, please see KB5020805:
How to manage Kerberos protocol changes related to CVE-2022-37967 for further information on how to configure KrbtgtFullPacSignature.

Possible memory leak in Local Security Authority Subsystem Service (LSASS.exe) for Windows Server 2016

Possible memory leak in Local Security Authority Subsystem Service (LSASS.exe) for Windows Server 2019

 

Have a nice day!

How to Find Local Group Members from Remote Servers

If you need to list local group members belonging to remote servers , you can use two different powershell commands below.

By the way If the Windows Remote Management (WinRM) service is turned off on your remote servers, “Invoke-Command” doesn’t work.

$Servers = Get-Content C:\Temp\BulkServers.txt
Foreach ($Server in $Servers)
{
Invoke-Command -ComputerName $Server -ScriptBlock {Get-LocalGroupMember -Group "Remote Desktop Users"} | Select PSComputerName,Name
}

or

$Servers = Get-Content C:\Temp\BulkServers.txt
Foreach ($Server in $Servers)
{
$Groups = Get-WmiObject Win32_GroupUser –Computer $Server
$RDPUsers = $Groups | Where GroupComponent –like '*"Remote Desktop Users"'

Write-Host "Server: $Server"
Write-Host " "
$RDPUsers |% {

$_.partcomponent –match ".+Domain=(.+)\,Name=(.+)$" > $null
$matches[1].trim('"') + "\" + $matches[2].trim('"')
}
Write-Host " "
}

To list other group members, simply change the “Remote Desktop Users” group information.

Have a nice day !

How to Bulk Add DNS A Records

If you want to add A records in bulk, you must first edit the A records you want to add as a “.csv” file.

Then it will be enough to run the following powershell line.

Import-Csv .\dns.csv | ForEach-Object { Add-DnsServerResourceRecordA -Name $_.Name -IPv4Address $_.IPv4Address -ZoneName yusufustundag.com -ComputerName PDC -CreatePtr}

If you want to check the A records run the following powershell line.

Get-DnsServerResourceRecord -ZoneName yusufustundag.com -RRType A

Have a nice day!

How to your organization mitigate the risk of a Pass-the-Hash (PtH) attack?

This mitigation strategies that you can use in your organization to help prevent both lateral movement and privilege escalation by decreasing the impact of credential theft.

Lateral Movement: In this activity, the attacker uses the credentials obtained from a compromised computer to gain access to another computer of the same value to the organization.

Privilege Escalation: In this activity, the attacker uses the credentials obtained from a compromised computer to gain access to another computer of a higher value to the organization.

These mitigations are effective, practical, and broadly applicable to different domain configurations.

These mitigations are defense-in-depth measures designed to ensure that your environment is protected even if these measures fail.

MitigationEffectivenessEffort RequiredPrivilege EscalationLateral Movement
Restrict and protect local accounts with Administrative PrivilegesExcellentMedium
Restrict and protect local accounts with Administrative PrivilegesExcellentLow
Restrict inbound traffic using the Windows FirewallExcellentMedium
More RecommendationsEffectivenessEffort RequiredPrivilege EscalationLateral Movement
Remove standard users from the local Administrators GroupExcellentHigh
Limit the number and use of privileged Domain AccountsGoodMedium
Configure outbound proxies to deny internet to Privileged AccountsGoodLow
Ensure Administrative Accounts don’t have email accountsGoodLow
Use remote management tools that don’t place reusable credentials on a remote computers memoryGoodMedium
Avoid logons to less secure computers that are potentially compromisedGoodLow
Update applications and operating systemsPartialMedium
Secure and manage Domain ControllersPartialMedium
Remove LM hashesPartialLow
Other MitigationEffectivenessEffort RequiredPrivilege EscalationLateral Movement
Disable the NTLM ProtocolMinimalHigh
Smart cards and multifactor authentication (MFA)MinimalHigh
Jump serversMinimalHigh
Rebooting workstations and serversMinimalLow

Have a nice day!

How to Force Active Directory Replication

If you make a changes on DC01 and you want to replicate those to other DCs instantly, run command repadmin /syncall /APeD on DC01.

A = All Partitions
P = Push
e = Enterprise (Cross Site)
D = Identify servers by distinguished names

If DC01 is out of sync, you should run command repadmin /syncall /AeD on DC01.
This will do a pull replication, which means it will pull updates from DC02 to DC01.

Supported flags case sensitive.

Have a nice day!

How to Check Active Directory Replication

Repadmin.exe helps system administrators diagnose Active Directory replication problems between domain controllers running Microsoft Windows operating systems.

For more about repadmin.exe

If you want view replication status and general health status, using command “/replsummary”.
This command will show you the percentage of replication attempts (Largest Delta/ Fails/Total/Error).
repadmin /replsummary

If you want view replication partner and status, using command “/showrepl”.
This command displays the GUID of each object that was replicated and it’s result.
repadmin /showrepl

Only to see the fail;
repadmin /showrepl /errorsonly

For other commands

If you don’t want to use commands, try this “Active Directory Replication Status Tool” 🙂

Have a nice day!

How to Get Domain Controller Information with Powershell

You can use the script below to discover your Domain Controller servers in your system.

(Get-ADForest).Domains | % { Get-ADDomainController -Discover -DomainName $_ } | % { Get-ADDomainController -server $_.Name -filter * }

ComputerObjectDN : Domain Controller Object Distinguished Name
DefaultPartition : Domain Partition
Domain : Domain Name
Enabled : Domain Status
Forest : Active Directory Forest Name
HostName : Domain Controller Host Name
InvocationId : The invocation ID identifies the version or the instantiation of the Active Directory database that is running on a given domain controller.
IPv4Address : Domain Controller IPv4 Address
IPv6Address : Domain Controller IPv6 Address
IsGlobalCatalog : Active Directory Global Catalog Status
IsReadOnly : Read-Only Domain Controllers Status
LdapPort : Domain Controller Ldap Port Number
Name : Domain Controller Computer Name
NTDSSettingsObjectDN : NTDS Settings Object Distinguished Name
OperatingSystem : Domain Controller Operation System
OperatingSystemHotfix : Domain Controller Operation Hotfix
OperatingSystemServicePack : Domain Controller Operation System Service Pack
OperatingSystemVersion : Domain Controller Operation System Version Build Number
OperationMasterRoles : Active Directory Flexible Single Master Operation (FSMO) Roles
Partitions : Domain Controller Partitions
ServerObjectDN : Server Object Distinguished Name
ServerObjectGuid : Server Object GUID Vaule
Site : Active Directory Site Name
SslPort : Domain Controller Ssl Port Number

You can customize the above criteria according to your needs and list them using the select command.

Example shell :

(Get-ADForest).Domains | % { Get-ADDomainController -Discover -DomainName $_ } | % { Get-ADDomainController -server $_.Name -filter * } | Select Name, Domain, Forest, IPv4Address, Site ,OperatingSystem, Operating
SystemVersion, OperationMasterRoles,IsGlobalCatalog | ft ( or Out-GridView)

Have a nice day!