Microsoft Ignite NZ 25 28 October 2016 SKYCITY

Microsoft Ignite NZ 25 -28 October 2016 SKYCITY, Auckland

Righting the Rights: Active Directory & Domain Security, Administration & Maintenance M 354 Jess Dodson

https: //telepathwords. research. microsoft. com/

Replication FSMO Roles Time Synchronization Trusts DNS & Networking Event Logs Account Administration Azure – AADC & AADC Health

repadmin /replsummary

repadmin /showrepl * /errorsonly

repadmin /showutdvec * dc=<domain>, dc=<com>

repadmin /queue *

repadmin /failcache

netdom query fsmo

w 32 tm /config /manualpeerlist: <list of time servers> /syncfromflags: manual /reliable: yes /update W 32 tm /config /syncfromflags: domhier /update

type %systemroot%debugnetlogon. log | findstr NO_CLIENT_SITE

Ports 389 – LDAP 636 – LDAP SSL 3268 – LDAP GC 3269 – LDAP GC SSL 135 – EPC, EPM 53 – DNS 88 – Kerberos 445 – SMB/IP 139 – Net. BIOS Session Port 123 – NTP Time Services

System Events 29: Time synchronization failure 55: Possible file system corruption 1056: DHCP service is running on a DC without credentials 16645: RID Pool depleted 16650: Account-identifier failed to initialize

DNS Events 5774: DNS registration failure 5775: DNS de-registration failure 5781: DNS registration or deregistration failure

Security & Directory Service events ALL events

Advanced Audit Policies (GPO) Computer Configuration – Windows Settings – Security Settings – Advanced Audit Configuration

Account lockout failures & failed login attempts

Check admin group memberships & monitor addition/removal from security groups Enterprise Admins Schema Admins Domain Admins Administrators Backup Operators Event Log Readers Remote Management Users Server Operators

Azure Active Directory Connect Synchronization Service Manager

Azure Active Directory Connect Synchronization Service Manager status = success Office 365 - Settings - > Organization profile -> Technical Contact

Azure Active Directory Connect Health Requires Azure AD Premium Requires agent on each identity server Out-of-the-box monitoring – very little configuration Monitors AD DS & AD FS + AADC sync info https: //azure. microsoft. com/en-us/documentation/articles/activedirectory-aadconnect-health/

Azure Active Directory Connect Health

Continue your Ignite learning path Pass-the-Hash Attacks http: //bit. ly/2 d. VT 0 ng Advanced Audit Policies http: //bit. ly/2 d. Mcta. U Securing Active Directory: Best Practices http: //aka. ms/bpsad LAPS https: //adsecurity. org/? p=1790 Microsoft Security Compliance Manager http: //aka. ms/scm

Continue your Ignite learning path AD Security & Administration http: //girl-germs. com/? p=459 Advanced Audit Policy Event. ID info https: //girl-germs. com/? p=363 Regular AD Maintenance & Checks http: //girl-germs. com/? p=564 DC Security Logs http: //girl-germs. com/? p=1538 FGPP’s & PSO’s http: //girl-germs. com/? p=967

Contact me! Twitter: @girlgerms (best way!) Email: jess@girl-germs. com Linkedin: https: //au. linkedin. com/in/jrdodson Blog: http: //girl-germs. com

Questions?