Reputation
Top tag
Next privilege 50 Rep.
Comment everywhere
Badges
8
Impact
~1k people reached

  • 0 posts edited
  • 0 helpful flags
  • 2 votes cast
Aug
6
awarded  Popular Question
Jul
4
awarded  Benefactor
Jul
4
accepted How to prevent remote code execution from a domain member server?
Jul
3
comment How to prevent remote code execution from a domain member server?
Thanks for your update. To help you understand what I'm getting at, think of a *NIX server with an LDAP server and an SSH server. The capabilities of one service (authenticating users, browsing the directory) can easily be kept separate from those of the other (gaining a remote shell) because they listen on different ports. If a machine only has access to LDAP, they can't get a remote shell no matter what credentials they have. -- I was hoping some kind of equivalent setup could be done in Windows/AD but increasingly that seems not to be the case.
Jul
1
comment How to prevent remote code execution from a domain member server?
"consider creating a separate domain (in a separate forest) for those hosts and managing them separately...also consider not joining them to a domain at all" -- this is where I'm at right now.
Jul
1
comment How to prevent remote code execution from a domain member server?
Thanks for your answer. "If you join a domain, the domain is allowed to sign users into existence on your computer and apply GPOs to it" -- I'm not trying to protect the member from the domain (which can apply GPOs), I'm trying to protect the rest of the domain from the member (which apparently, by being a member, must have the network access needed to remotely execute code on a DC). "Using an RODC in the enclave will protect the domain from your enclave" Will it though? Our attacker will simply have to open a second remote shell (one on the RODC, one from the RODC to the DC).
Jun
28
awarded  Promoter
Jun
22
comment How to prevent remote code execution from a domain member server?
I thought of this, but the attacker in my scenario could just open up a second remote shell / psexec / whatever, right? i.e. psexec to dc-readonly, psexec from dc-readonly to dc1 and dc2.
Jun
16
comment How to prevent remote code execution from a domain member server?
Yeah we might just have to settle for an approach like that (locking down things on DCs and member1).
Jun
16
comment How to prevent remote code execution from a domain member server?
> What's to stop Jack from logging on to any other server besides member1, including a DC? A firewall. There is a firewall between member1 and the DCs. For the purposes of this example, imagine that there's a member2, also inaccessible because of the firewall. > If "Jill" is susceptible to social engineering SE is just an example. There are other ways for an internal user to obtain credentials...it's easier than some might think.
Jun
16
asked How to prevent remote code execution from a domain member server?
Apr
3
awarded  Scholar
Apr
3
accepted Exchange transport rule to silently ignore messages sent to a bogus address?
Apr
3
answered Exchange transport rule to silently ignore messages sent to a bogus address?
Apr
2
awarded  Student
Apr
1
awarded  Editor
Apr
1
comment Exchange transport rule to silently ignore messages sent to a bogus address?
thanks for the answer. I'd prefer just to drop the messages because they are not needed. I've updated my question.
Apr
1
revised Exchange transport rule to silently ignore messages sent to a bogus address?
added 162 characters in body
Apr
1
asked Exchange transport rule to silently ignore messages sent to a bogus address?
Feb
22
awarded  Teacher