2/ We talked about passwords in SYSVOL before:
https://twitter.com/malmoeb/status/1522499535158796290
4/ Ensure to periodically check the properties of the AD objects, which could include passwords, left in the Description.
5/ "LAPS is the Microsoft solution to automatically manage the password for the built-in Administrator account on Windows devices. When machines are built or imaged, they often have the same password for the built-in Administrator account.
6/ If this is never changed, a single password can give local administrative rights to all machines and may provide opportunities for lateral movement. LAPS solves this problem by ensuring each device has a unique local administrator password and rotates it regularly." [1]
7/ In our incident response cases, we regularly see local administrators or accounts that are part of the local administrator's group in combination with a weak password - an ideal target for lateral movement.
Reference:
[1] techcommunity.microsoft.com/t5/microsoft-s…
Reference:
[1] techcommunity.microsoft.com/t5/microsoft-s…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
