21,839 reputation
3 23 48

Greg Askew

Good write-up of the various methods used by your adversaries to compromise Active Directory security:


If you are using Windows 7/2008 R2, KB2871997 should be installed to ensure that Windows credentials are removed upon logoff. Without this hotfix, administrator credentials remain in memory until the computer is restarted, which significantly elevates the risk of pass-the-hash attacks.

Additionally, WDigest credentials are enabled by default in Windows 7/2008 R2, which results in plain text credentials being stored in memory. (WDigest credentials are disabled by default in Windows 8.1\2012 R2 and later). This should be disabled using the registry fix in the article:


Good overview of the new Isolated User Mode feature of Windows 10/Server 2016 and how that can protect against pass-the-hash attacks:


AD Security definitive reference:


Enterprise Administrator at one of the largest Microsoft Active Directory installations in the world. In addition to most things Microsoft and Windows, I also maintain IIS/SQL Servers and write code for managing the infrastructure of the organization.

Top Tags (544)

Score 477
Posts 243
Posts % 26
Score 312
Posts 176
Score 240
Posts 144
Score 201
Posts 99
Score 142
Posts 77
Score 128
Posts 74

Top Posts (918) All Questions Answers | Votes Newest

View all questions and answers

Badges (74)

Gold 3


Silver 23


Bronze 48