Security

Ask something
Question Locked

Help with AD security

0 helpful
8 replies

by spelunkdude

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I believe our AD may have been compromised. A user with
no Ad rights disabled an account. I reviewed their permissions and they have non to accomplish this.
I feel that in the past this user may have had been given delegation rights or some sort of LDAP rights. I need to audit all security on AD to find the hole.
I hoping someone might know of a good tool to accomplish this.

8 replies

by larryd4

I don't know of a tool, but the only account level permission that can disable a user account is an administrator.

Could this person know you Domain or Local Server Admin Password?

by spelunkdude

He is a programmer who has been here for yrs. and we recently changed the Domain and local passwords.

by larryd4

Well I would get to work. The type of looking and discovering, to see what type "programs" may be running or manipulating your, network will be a long one.

First place to start is to analyze and confirm every task currently running on the server as well as any service that may be loaded. If you notice a wscript task its an indication of a VB script running.

If you really think that their may be a rogue app or something like that. You'll have to go from device to device and look at eveything. Once confirmed clean, keep the device off the network until you can elliminate all the other devices.

Sorry to sound so horrid, but better safe then sorry.

by larryd4

Could someone have simply tried to log in to the account to many times resulting in the account being locked out?

by spelunkdude

No the user is no longer here and we had changed his password so we could still receive his emails for awhile.

This discussion is closed to new replies.