Ing. Ondřej Ševeček MCSM:Directory | MVP:Enterprise Security | Certified Ethical Hacker | MCSE:SharePoint | Event Filtering and Searching with XPath and PowerShell SCOM ACS bohužel nebude, zato bude víc ostatního

Auditing (2000+)

Granular auditing (2008/Vista+)

Event viewer

Event viewer and XML

XPath  XML "searching" language  Quick examples //State[population>20] /States/State[starts-with(display, 'C') //State[position()=3] /States/*[starts-with(display, 'C')] //display[starts-with(., 'C')] //display[starts-with(text(), 'C')]

XPath  Event viewer must replace with > must replace <= with <= can use only position(), Band() and timediff() today: <= ]]  WEVTUTIL normal operators >, >=, <=, != …

Logon auditing  Account Logon Event –"authentication event" –when an account database validates credentials  Logon Event –"session event" –every time an Access Token is created or closed

NTLM and Schannel network logon DC Client Server App Traffic DC SMB D/COM In-band NTLM hash Pass-through NTLM hash D/COM Dynamic TCP

Kerberos network logon (basic principle) DC Client Kerberos Server App Traffic TGT: User In-band TGS: Server

Auditing (Interactive Logon) SQL FS WFE SQL FS WFE DC Client Account Logon 1 Logon 2

Logon types TypeValue Interactive2 Network3 Batch4 Service5 Unlock7 NetworkCleartext8 NewCredentials9 RemoteInteractive10 CachedInteractive11 CachedRemoteInteractive12 CachedUnlock13

Status codes StatusValue STATUS_WRONG_PASSWORD0xC000006A STATUS_PASSWORD_RESTRICTION0xC000006C STATUS_LOGON_FAILURE0xC000006D STATUS_ACCOUNT_RESTRICTION0xC000006E STATUS_INVALID_LOGON_HOURS0xC000006F STATUS_INVALID_WORKSTATION0xC STATUS_PASSWORD_EXPIRED0xC STATUS_ACCOUNT_DISABLED0xC STATUS_LOGON_NOT_GRANTED0xC STATUS_LOGON_TYPE_NOT_GRANTED0xC000015B STATUS_ACCOUNT_EXPIRED0xC STATUS_PASSWORD_MUST_CHANGE0xC STATUS_ACCOUNT_LOCKED_OUT0xC

Download err.exe  version 2008 –  most up-to-date version –SDK for Windows 8.1 –

Auditing (Network session) SQL FS WFE SQL FS WFE DC Client Account Logon 1 Logon 2

immediately at logoff Auditing (Interactive logoff) SQL FS WFE SQL FS WFE DC Client Logoff1

SQL FS WFE SQL FS WFE when TCP connection closed Auditing (Network session) DC Client Logoff1

PowerShell notes  Get-WmiObject -Computer -Query  EventCode, InsertionStrings

Timestamps in LDAP  pwdLastSet  lastLogon –non-replicated  lastLogonTimestamp  lockoutTime  badPasswordTime –non-replicated  accountExpires

Logon timestamps Client DC lastLogon 11:38 lastLogon 9:00 lastLogon - -

Logon timestamps (2003 DFL) Client DC lastLogon 11:38 lastLogon 9:00 lastLogon - - lastLogonTimestamp 11:00 lastLogonTimestamp 11:00 lastLogonTimestamp 11:00

lastLogonTimestamp  Requires 2003 domain functional level  Updated only once per 14-random(5) days –DC=idtt,DC=local –msDS-LogonTimeSyncInterval –1+ – minimum without randomization –5+ – randomization starts –14 – the default –...

Authentication failures Client PDC pwd2 DC pwd2 DC pwd1

Authentication failures Client DC badPasswordCount PDC badPasswordCount 7 7 lockoutTime DC badPasswordCount 2 2

Searching in LDAP  (name=m*)  (&(name=m*)(c=cz))  (|(c=cz)(c=de))  (!c=cz)  (whenCreated>= )  (whenCreated>= Z)  (pwdLastSet>= )  (userAccountControl: :=2)

Powershell and DateTime  get-date  [DateTime]::Parse(" ")  (get-date).AddDays(-50)  ((get-date) – [DateTime]::Parse(" ")).Ticks  ([DateTime]::Parse(" ") – [DateTime]::Parse(" ")).Ticks  ((get-date).AddDays(-50) – [DateTime]::Parse(" ")).Ticks

Kurzy Počítačové školy Gopas na GOC170 - AD Monitoring with SCOM and ACS GOC171 - Active Directory Troubleshooting GOC172 - Kerberos Troubleshooting GOC173 - Enterprise PKI GOC174 - SharePoint Architecture and Troubleshooting GOC175 - Advanced Security GOC169 - Auditing ISO/IEC 2700x Získejte tričko TechEd 2014 za vyplněný hodnotící dotazník. Počítačová škola Gopas – Vaše IT škola života