2/ To raise the bar again, add critical accounts to the Protected Users Security Group.
"This group provides protections over and above just preventing delegation and makes them even more secure; however, it may cause operational issues, so it is worth testing in your env." [2]
"This group provides protections over and above just preventing delegation and makes them even more secure; however, it may cause operational issues, so it is worth testing in your env." [2]
3/ Benefits:
1⃣ Credential delegation (CredSSP) will not cache the user's plain text credentials [..]
2⃣ Beginning with Windows 8.1 and Windows Server 2012 R2, Windows Digest will not cache the user's plain text credentials even when Windows Digest is enabled.
1⃣ Credential delegation (CredSSP) will not cache the user's plain text credentials [..]
2⃣ Beginning with Windows 8.1 and Windows Server 2012 R2, Windows Digest will not cache the user's plain text credentials even when Windows Digest is enabled.
4/ 3⃣ NTLM will not cache the user's plain text credentials or NT one-way function (NTOWF).
4⃣ Kerberos will no longer create DES or RC4 keys. Also it will not cache the user's plain text credentials or long-term keys after the initial TGT is acquired.
Source: [1]
4⃣ Kerberos will no longer create DES or RC4 keys. Also it will not cache the user's plain text credentials or long-term keys after the initial TGT is acquired.
Source: [1]
5/ Accounts that are members of the Protected Users group that authenticate to a Windows Server 2012 R2 domain are unable to:
✅ Authenticate with NTLM authentication.
✅ Use DES or RC4 encryption types in Kerberos pre-authentication.
✅ Authenticate with NTLM authentication.
✅ Use DES or RC4 encryption types in Kerberos pre-authentication.
6/
✅ Be delegated with unconstrained or constrained delegation.
✅ Renew the Kerberos TGTs beyond the initial four-hour lifetime.
Source: [1]
✅ Be delegated with unconstrained or constrained delegation.
✅ Renew the Kerberos TGTs beyond the initial four-hour lifetime.
Source: [1]
7/ A word of advise ⚠️:
"Accounts for services and computers should never be members of the Protected Users group. This group provides incomplete protection anyway, because the password or certificate is always available on the host.
"Accounts for services and computers should never be members of the Protected Users group. This group provides incomplete protection anyway, because the password or certificate is always available on the host.
8/ References:
[1] learn.microsoft.com/en-us/windows-…
[2] techcommunity.microsoft.com/t5/microsoft-s…
[1] learn.microsoft.com/en-us/windows-…
[2] techcommunity.microsoft.com/t5/microsoft-s…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
