_raw:
Advised solution:
To enable Kerberos armoring for domain controllers, edit the GPO and go to Computer Configuration > Administrative Templates > System > KDC


_raw: If Kerberos Armoring is requested for other operating systems (such as Windows 7 or Linux), the Kerberos authentication protocol may refuse to work.<br>


_raw: It is supported only starting Windows Server 2012 DC and Windows 8 workstations.<br>


_raw:
Technical explanation:
Kerberos Armoring is an optimization of the Kerberos protocol. It avoids the pre-authentication steps and thereby prevents pre-authentication attacks.


_raw:
Description:
The purpose is to ensure that DC supports Kerberos armoring when functional level is at least Windows Server 2012


_raw: Ensure that DC supports Kerberos armoring when functional level is at least Windows Server 2012


_raw: <div id="rulesS-KerberosArmoringDC" class="collapse" aria-labelledby="headingrulesS-KerberosArmoringDC" data-parent="#rulesStaleObjects">


_raw: Verify Kerberos Armoring is enabled on DCs and the domain functional level is at least Windows Server 2012


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-KerberosArmoringDC" aria-expanded="false" aria-controls="rulesS-KerberosArmoringDC">


_raw:
[MITRE]T1558 Steal or Forge Kerberos Tickets
Details:
If activated, the detail can be found in Security settings


_raw: then enable the policy "Kerberos client support for claims, compound authentication and Kerberos armoring".</p>


_raw:
Advised solution:
To enable Kerberos armoring for client, edit the GPO and go to Computer Configuration > Administrative Templates > System > Kerberos


_raw: If Kerberos armoring is requested for other operating systems (such as Windows 7 or Linux), the Kerberos authentication protocol may refuse to work.<br>


_raw:
Technical explanation:
Kerberos Armoring is an optimization of the Kerberos protocol. It avoids the pre-authentication steps thus prohibiting pre-authentication attacks;


_raw:
Description:
The purpose is to ensure that clients support Kerberos armoring when domain functional level is at least Windows Server 2012


_raw: Ensure that clients support Kerberos armoring when the domain functional level is at least Windows Server 2012


_raw: <div id="rulesS-KerberosArmoring" class="collapse" aria-labelledby="headingrulesS-KerberosArmoring" data-parent="#rulesStaleObjects">


_raw: Verify Kerberos Armoring is enabled on clients and the domain functional level is at least Windows Server 2012


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-KerberosArmoring" aria-expanded="false" aria-controls="rulesS-KerberosArmoring">


_raw:
[MITRE]T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
Details:
The detail can be found in User information and Computer information


_raw: [FR]ANSSI - Service accounts supported encryption algorithms (vuln3_kerberos_properties_encryption)3


_raw: For GMSA account, you have to manually edit the property msDS-SupportedEncryptionTypes</p>


_raw: It has to be enabled in the property of an account by checking all the boxes "This account supports Keberos AES XXX encryption".<br>


_raw:
Advised solution:
It is recommended to enable AES as an encryption algorithm in the user configuration dialog or in the "msDSSupportedEncryptionTypes" attribute at LDAP level.


_raw: Also be advised that other checks must be performed before disabling RC4 (such as trust accounts, ...). A dedicated section in this report explores AES compatibility.<br>


_raw: 2) they have a SPN and the account is not flaged to use AES for encryption with msDS-SupportedEncryptionTypes<br>


_raw: 1) no password changed occured after the first DC Win 2008 install to initate AES secrets or <br>


_raw: Without this configuration, AES will not be fully operational.<br>


_raw: It’s important to note that service accounts and user accounts with the ‘serviceprincipalname’ attribute (also known as SPN) need to be configured to support AES. <br>


_raw: Before disabling RC4, the first step is to enable AES.<br>


_raw: However, due to the rapid advancements in computing power, it’s recommended to transition from RC4 to the more secure AES algorithm.<br>


_raw:
Technical explanation:
The default encryption algorithm used by Kerberos is RC4, which directly utilizes the NTLM hash of the user’s password.


_raw:
Description:
The purpose is to verify that AES is enabled for service accounts.


_raw: Check the use of Kerberos on services accounts without AES support


_raw: <div id="rulesS-AesNotEnabled" class="collapse" aria-labelledby="headingrulesS-AesNotEnabled" data-parent="#rulesStaleObjects">


_raw: Presence of service accounts without AES support = 2856


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-AesNotEnabled" aria-expanded="false" aria-controls="rulesS-AesNotEnabled">


_raw:
Extension	Reason

js 	Not found in Folder Options

jse 	Not found in Folder Options

vbs 	Not found in Folder Options

vbe 	Not found in Folder Options

vb 	Not found in Folder Options

wsh 	Not found in Folder Options

wsf 	Not found in Folder Options


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Folder Options


_raw: In "Configure class settings", add a new "open" action with Notepad as the default application: C:\Windows\System32\notepad.exe.<br>


_raw: Create a new File Type with the "Replace" action for the extension you wish to secure.<br>


_raw:
Advised solution:
Navigate to Computer Configuration > Preferences > Windows Settings > Control Panel > Folder Options.


_raw: But we still recommend to apply the folder options mitigation as it is more effective.<br>


_raw: Note: Javascript execution can be mitigated by an "Attack surface reduction rule" named "Impede JavaScript and VBScript to launch executables" available since Windows 10, version 1709.<br>


_raw: Review is recommended for other script files before implementing this security measure.<br>


_raw: The browser navigation is not impacted by this recommendation.<br>


_raw: Redirecting these files to open in Notepad safeguards against inadvertent execution without affecting web browsing.<br>


_raw: While .js and .jse files are commonly associated with web content and handled by browsers, it’s crucial to recognize their potential for harm when executed directly in Windows.<br>


_raw: However, several legacy script extensions (.js, .jse, .vbs, .vbe, .vb, .wsh, .wsf) still execute with their respective engines. <br>


_raw:
Technical explanation:
By default, PowerShell scripts (.ps1) open in Notepad, which blocks these extensions from being exploited in phishing attacks that evade email filters through multi-layered archives.


_raw:
Description:
The objective is to ensure scripts do not automatically execute upon opening by default.


_raw: Verify the Default Application for Script File Execution


_raw: <div id="rulesS-FolderOptions" class="collapse" aria-labelledby="headingrulesS-FolderOptions" data-parent="#rulesStaleObjects">


_raw: Some script extensions, used in phishing, can be directly run by double clicking on it


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-FolderOptions" aria-expanded="false" aria-controls="rulesS-FolderOptions">


_raw:
Guid	Label	Reason

7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c 	Block Adobe Reader from creating child processes 	Not found - Block or Warn recommended

9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 	Block credential stealing from the Windows local security authority subsystem (lsass.exe) 	Not found - Block or Warn recommended

be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 	Block executable content from email client and webmail 	Not found - Block or Warn recommended

d3e037e1-3eb8-44c8-a917-57927947596d 	Block JavaScript or VBScript from launching downloaded executable content 	Not found - Block or Warn recommended

3b576869-a4ec-4529-8536-b80a7769e899 	Block Office applications from creating executable content 	Not found - Block or Warn recommended

e6db77e5-3df2-4cf1-b95a-636979351e5b 	Block persistence through WMI event subscription 	Not found - Block or Warn recommended

b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 	Block untrusted and unsigned processes that run from USB 	Not found - Block or Warn recommended

56a863a9-875e-4185-98a7-b882c64b5ce5 	Block abuse of exploited vulnerable signed drivers 	Not found - Block or Warn recommended

75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 	Block Office applications from injecting code into other processes 	Not found - Audit recommended

92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b 	Block Win32 API calls from Office macros 	Not found - Audit recommended

d4f940ab-401b-4efc-aadc-ad5f3c50688a 	Block all Office applications from creating child processes 	Not found - Audit recommended

5beb7efe-fd9a-4556-801d-275e5ffc04cc 	Block execution of potentially obfuscated scripts 	Not found - Audit recommended

01443614-cd74-433a-b99e-2ecdc07bfc25 	Block executable files from running unless they meet a prevalence, age, or trusted list criterion 	Not found - Audit recommended

c1db55ab-c21a-4637-bb3f-a12568109d35 	Use advanced protection against ransomware 	Not found - Audit recommended

d1e49aac-8f56-4280-b9ba-993a6d77406c 	Block process creations originating from PSExec and WMI commands 	Not found - Audit recommended

26190899-1602-49e8-8b27-eb1d0a1ce869 	Block Office communication application from creating child processes 	Not found - Audit recommended

33ddedf1-c6e0-47cb-833e-de6133960387 	Block rebooting machine in Safe Mode (preview) 	Not found - Audit recommended

c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb 	Block use of copied or impersonated system tools (preview) 	Not found - Audit recommended


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Defender ASR


_raw: Prior to implementation, conduct an impact analysis to anticipate any potential disruptions, and utilize Audit mode to identify possible issues.<br>


_raw: It is recommended to set Defender ASR rules as recommended in the article below.<br>


_raw: For instance, to block JavaScript or VBScript from executing downloaded executable content, use the GUID: d3e037e1-3eb8-44c8-a917-57927947596d.<br>


_raw: Other configurable values include 2 for Audit mode and 6 for Warn mode.<br>


_raw: Then, input the mitigation’s GUID as the Value name and assign 1 as the Value to enforce the rule in Block mode.<br>


_raw: Upon enabling this setting, select "Set the state for each ASR rule".<br>


_raw:
Advised solution:
To apply an ASR mitigation, navigate to the GPO setting "Configure Attack Surface Reduction rules" found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction.


_raw: Note: Windows 11 may enable in some conditions those 3 ASR rules: Block abuse of exploited vulnerable signed drivers, Block credential stealing from the Windows local security authority subsystem (lsass.exe), Block persistence through WMI event subscription<br>


_raw: These protections have been part of Windows since the release of Windows 10 version 1710 and are also applicable to Windows Server 2012 R2.<br>


_raw: Defender’s ASR features, designed to minimize vulnerability to attacks, are available even in the standard version.<br>


_raw:
Technical explanation:
Microsoft Defender, the default antivirus included with Windows, activates automatically on systems without a pre-installed alternative.


_raw:
Description:
This rule confirms the activation of Defender ASR (Attack Surface Reduction) mitigations within a Group Policy Object (GPO).


_raw: Verify that Defender ASR mitigations are in place


_raw: <div id="rulesS-DefenderASR" class="collapse" aria-labelledby="headingrulesS-DefenderASR" data-parent="#rulesStaleObjects">


_raw: Not all possible Defender ASR mitigations are in Block or Warn mode


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-DefenderASR" aria-expanded="false" aria-controls="rulesS-DefenderASR">


_raw:
Program	Reason

wscript.exe 	No Firewall rules found

mshta.exe 	No Firewall rules found

cscript.exe 	No Firewall rules found

conhost.exe 	No Firewall rules found

runScriptHelper.exe 	No Firewall rules found


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Firewall configuration


_raw: Alternatively, you can choose to apply the rules to ALL IP addresses or add your internal proxy IP.<br>


_raw: We recommend setting the rules as active for the following IP address ranges to allow local network access:<br>


_raw: Ensure the rules are applied on the Outbound side.<br>


_raw: Configure the firewall rules under Computer Configuration / Policies / Windows Settings / Security Settings / Windows Defender Firewall with Advanced Security.<br>


_raw:
Advised solution:
1) Create Firewall Rules via GPO


_raw: The current list of programs to restrict includes: wscript.exe, mshta.exe, cscript.exe, conhost.exe, and runScriptHelper.exe.<br>


_raw: These rules will prohibit direct internet connections for specific programs.<br>


_raw: To mitigate this risk, we recommend implementing a set of firewall rules through Group Policy Objects (GPOs).<br>


_raw:
Technical explanation:
Malicious scripts, often distributed via phishing emails, frequently attempt to connect to the internet to propagate their infection.


_raw:
Description:
This rule verifies whether programs, such as script engines, are allowed to connect to the internet by default.


_raw: Verify if there are restrictions for internet connectivity of script engines


_raw: <div id="rulesS-FirewallScript" class="collapse" aria-labelledby="headingrulesS-FirewallScript" data-parent="#rulesStaleObjects">


_raw: It is possible for scripts engine used by hackers to connect directly to the Internet


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-FirewallScript" aria-expanded="false" aria-controls="rulesS-FirewallScript">


_raw:
DN

CN=Guest,CN=Users,DC=allports,DC=local

CN=cloudbase-init,CN=Users,DC=allports,DC=local

CN=Admin,CN=Users,DC=allports,DC=local


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in User information


_raw: [FR]ANSSI - Accounts with never-expiring passwords (vuln2_dont_expire)2


_raw: Netwrix Privilege Secure helps mandate regular password updates for privileged accounts, regardless of expiration settings, with strong, complex passwords to mitigate long-term compromise risks.


_raw: Netwrix Directory Manager</a> automatically enforces secure configurations during account creation or management to ensure the "Password Never Expires" setting is not misused. </li>


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_S_PwdNeverExpires">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_S_PwdNeverExpires" aria-controls="relevantProducts_S_PwdNeverExpires">


_raw: Also Linux servers should be configured with automatic machine account change.</p>


_raw: Please note that there is a document in the section below which references solutions for service accounts of well known products.<br>


_raw: For services accounts, Windows provide the "managed service accounts" and "group managed service accounts" features to facilite the automatic change of passwords.<br>


_raw:
Advised solution:
In order to make Active Directory enforce periodic password change, accounts must not have the "Password never expires" flag set in the "Account" tab of the user properties. Their passwords should then be rolled immediately.


_raw: See one of the link below for more information.</p>


_raw: This is a misconfiguration because a password change can be configured. It was however not the default on some plateform.<br>


_raw: We have noted that some Linux servers, domain joined, are configured with a password which never expires.<br>


_raw:
Technical explanation:
Some accounts have passwords which never expire. Should an attacker compromise one of these accounts, he would be able to maintain long-term access to the Active Directory domain.


_raw:
Description:
The purpose is to ensure that every account has a password which is compliant with password expiration policies


_raw: Check that there is no account with never-expiring passwords


_raw: <div id="rulesS-PwdNeverExpires" class="collapse" aria-labelledby="headingrulesS-PwdNeverExpires" data-parent="#rulesStaleObjects">


_raw: Number of accounts which have never expiring passwords: 3


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-PwdNeverExpires" aria-expanded="false" aria-controls="rulesS-PwdNeverExpires">


_raw:
Domain controller	ip

APT-DC-01 	10.0.1.6


_raw: <table class="table table-striped table-bordered">


_raw:
Documentation:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in Domain controllers


_raw:
Advised solution:
Locate the IP address which was found as not being part of declared subnet, then add this subnet to the "Active Directory Sites" tool. If you have found IPv6 addresses and it was not expected, you should disable the IPv6 protocol on the network card.


_raw:
Technical explanation:
When multiple sites are created in a domain, networks should be declared in the domain in order to optimize processes such as DC attribution. In addition, PingCastle can collect the information to be able to build a network map. This rule has been triggered because at least one domain controller has an IP address which was not found in subnet declaration. These IP addresses have been collected by querying the DC FQDN IP address in both IPv6 and IPv4 format.


_raw:
Description:
The purpose is to ensure that the minimum set of subnet(s) has been configured in the domain


_raw: Check for completeness of network declaration


_raw: <div id="rulesS-DC-SubnetMissing" class="collapse" aria-labelledby="headingrulesS-DC-SubnetMissing" data-parent="#rulesStaleObjects">


_raw: The subnet declaration is incomplete [1 IP of DC not found in declared subnets]


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-DC-SubnetMissing" aria-expanded="false" aria-controls="rulesS-DC-SubnetMissing">


_raw: [FR]ANSSI - Unrestricted domain join (vuln4_user_accounts_machineaccountquota)4


_raw: [MITRE]Mitre Att&ck - Mitigation - User Account Management


_raw: Netwrix Directory Manager enables delegated management of computer accounts with least privilege controls, ensuring proper oversight of domain join operations.


_raw: Netwrix Privilege Secure helps dynamically assign permissions for machine additions only when required, removing persistent rights and reducing risk.


_raw: Netwrix Threat Manager monitors and optionally blocks unauthorized changes to domain policies, ensuring the security of computer account registrations and preventing privilege misuse.


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_S_ADRegistration">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_S_ADRegistration" aria-controls="relevantProducts_S_ADRegistration">


_raw:
Advised solution:
To solve the issue, limit the number of extra computers that can be registered by a basic user.  It can be reduced by modifying the value of ms-DS-MachineAccountQuota to zero (0). Another solution can be to remove the "Authenticated Users" group in the domain controllers policy altogether. Do note, that if you need to set delegation to an account, so it can add computers to the domain, it can be done through 2 methods: Delegation in the OU or by assigning the SeMachineAccountPrivilege to a special group


_raw: Note: this program checks also the GPO for SeMachineAccountPrivilege assignment. This assignment can be used to restrict the impact of the key ms-DS-MachineAccountQuota.</p>


_raw: If the value of the attribute ms-DS-MachineAccountQuota is not set (the program see this as "Infinite"), there is no limit to computer addition.<br>


_raw:
Technical explanation:
By default, a basic user can register up to 10 computers within the domain. This default configuration represents a security issue as basic users shouldn't be able to create such accounts and this task should be handled by administrators.


_raw:
Description:
The purpose is to ensure that basic users cannot register extra computers in the domain


_raw: Check the process of registration of computers to the domain


_raw: <div id="rulesS-ADRegistration" class="collapse" aria-labelledby="headingrulesS-ADRegistration" data-parent="#rulesStaleObjects">


_raw: Non-admin users can add up to 10 computer(s) to a domain


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-ADRegistration" aria-expanded="false" aria-controls="rulesS-ADRegistration">


_raw:
GPO	Value

Windows default without an active GPO 	3


_raw: <table class="table table-striped table-bordered">


_raw:
[FR]ANSSI - Recommandations de sécurité relatives à Active Directory - R37 [paragraph.3.6.2.1]
Details:
The detail can be found in Security settings


_raw: [MITRE]T1557.001 Man-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay


_raw: But please note that Ntlmv2 can be activited on all Windows starting Windows 95 and other operating systems.<br>


_raw: Beware that you may break software which is not compatible with Ntlmv2 such as very old Linux stacks or very old Windows before Windows Vista.<br>


_raw: The policy will be applied after a computer reboot.<br>


_raw: This can be done by editing the policy "Network security: LAN Manager authentication level" which can be accessed in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options<br>


_raw:
Advised solution:
After an audit of NTLMv1 usage (see the links below), you need to raise the LAN Manager Authentication Level to "Send NTLMv2 response only. Refuse LM & NTLM".


_raw: If no GPO defines the LAN Manager Authentication Level, the DC fall back to the non secure default.<br>


_raw: That means that by default, NTLMv1 is accepted on domain controllers.<br>


_raw: However Domain Controllers have relaxed default settings to accept the connection of older operating systems.<br>


_raw: Windows has default security settings regarding LM/NTLM. Windows XP: Send LM & NTLM responses, Windows Server 2003: Send NTLM response only, Vista/2008: Win7/2008 R2: Send NTLMv2 response only.<br>


_raw: This attack is still possible with NTLMv2 but this is more difficult.<br>


_raw: In this case, NTLMv1 can be specified so the hacker can retrieve the NTLM hash of the DC, impersonates it and then take control of the domain.<br>


_raw: This attack can be combined with coerced authentication attacks - a hacker forces the DC to connect to a controlled host.<br>


_raw: It is typically used when a hacker sniffs the network and tries to retrieve NTLM hashes which can then be used to impersonate users.<br>


_raw:
Technical explanation:
NTLMv1 is an old protocol which is known to be vulnerable to cryptographic attacks.


_raw:
Description:
The purpose is to check if NTLMv1 or LM can be used by DC


_raw: Ensure that the NTLMv1 and old LM protocols are banned


_raw: <div id="rulesS-OldNtlm" class="collapse" aria-labelledby="headingrulesS-OldNtlm" data-parent="#rulesStaleObjects">


_raw: The LAN Manager Authentication Level allows the use of NTLMv1 or LM.


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-OldNtlm" aria-expanded="false" aria-controls="rulesS-OldNtlm">


_raw: <table class="table table-striped table-bordered">


_raw:
[MITRE]Mitre Att&ck - Mitigation - Active Directory Configuration
Details:
The detail can be found in User information and Computer information


_raw: [FR]ANSSI - Recommandations de sécurité relatives à Active Directory - R36 [subsection.3.6]


_raw: Netwrix Privilege Secure enforces strong, complex passwords and prevents unauthorized use of the "PASSWD_NOTREQD" flag, eliminating password-less account vulnerabilities.


_raw: Netwrix Directory Manager</a> simplifies account creation and management by automatically enforcing proper configurations, ensuring the "Password Not Required" setting is never enabled. </li>


_raw: <div class="card-body collapse pb-0 pt-0" id="relevantProducts_S_PwdNotRequired">


_raw: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">


_raw: <div class="relevantproductsheader mb-2" data-bs-toggle="collapse" aria-expanded="false" href="#relevantProducts_S_PwdNotRequired" aria-controls="relevantProducts_S_PwdNotRequired">


_raw:
Advised solution:
The best solution to solve the problem is to change the "useraccountcontrol" attribute of all the accounts that have it and that are not used in trusts. If the flag is removed while there is no password set, you will have an error. You can use this to detect accounts without any passwords. Do note that you can manually check all the accounts that need to be worked on using the following PowerShell command: get-adobject -ldapfilter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -properties useraccountcontrol


_raw:
Technical explanation:
An account can be set without a password if it has the flag "PASSWD_NOTREQD" set as "True" in the "useraccountcontrol" attribute. This represents a high security risk as the account is not protected at all without a password


_raw:
Description:
The purpose is to ensure that every account requires a password


_raw: Check that every account requires a password


_raw: <div id="rulesS-PwdNotRequired" class="collapse" aria-labelledby="headingrulesS-PwdNotRequired" data-parent="#rulesStaleObjects">


_raw: Number of accounts which can have an empty password (can be overridden by GPO): 1


_raw: <button class="btn btn-link" data-bs-toggle="collapse" data-bs-target="#rulesS-PwdNotRequired" aria-expanded="false" aria-controls="rulesS-PwdNotRequired">


_raw: Stale Objects rule details [12 rules matched on a total of 56]


_raw: It is about operations related to user or computer objects


_raw: <div class="col-lg-9 col-md-8 col-xs-6 col-sm-6">


_raw: <div class=" col-lg-3 col-md-4 col-xs-6 col-sm-6">


_raw: <div class="card-body collapse show" id="panelsectionStaleObjects">


_raw:
This section represents an evaluation of the techniques available in the MITRE ATT&CK®

This feature is reserved for customers who have purchased a license


_raw: <div class="card-body collapse show" id="panelsectionMITREATTCK174">


_raw:
This section represents the maturity score (inspired from ANSSI).

This feature is reserved for customers who have purchased a license


_raw: <div class="card-body collapse show" id="panelsectionMaturityLevel">


_raw: <!-- Section Active Directory Indicators end -->


_raw: score higher than 30 - major risks identified


_raw: score between 10 and 30 - rules should be looked with attention


_raw: score between 1 and 10  - a few actions have been identified


_raw: score is 0 - no risk identified but some improvements detected


_raw:
The table below shows the settings that were not found as configured in a GPO for a given domain controller.

">Audit

<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 2 Score: 5" data-bs-html="true" data-bs-content="
It is possible for scripts engine used by hackers to connect directly to the Internet
The detail can be found in <a href="#gpofirewall">Firewall configuration</a>
The subnet declaration is incomplete [1 IP of DC not found in declared subnets]
The detail can be found in <a href="#domaincontrollersection">Domain controllers</a>

">Network topography

ACL Check

SID Filtering
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 1 Score: 5" data-bs-html="true" data-bs-content="
The number of DCs is too small to provide redundancy: 1 DC
The detail can be found in <a href="#domaincontrollersection">Domain controllers</a>

">Backup

<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 7 Score: 16" data-bs-html="true" data-bs-content="
The GPO are not pushing recommended configuration for Terminal Services
Not all possible Defender ASR mitigations are in Block or Warn mode
The detail can be found in <a href="#gpodefenderASR">Defender ASR</a>
Some script extensions, used in phishing, can be directly run by double clicking on it
The detail can be found in <a href="#gpofolderoptions">Folder Options</a>
Verify Kerberos Armoring is enabled on clients and the domain functional level is at least Windows Server 2012
If activated, the detail can be found in <a href="#lsasettings">Security settings</a>
Verify Kerberos Armoring is enabled on DCs and the domain functional level is at least Windows Server 2012
If activated, the detail can be found in <a href="#lsasettings">Security settings</a>
Number of accounts which have never expiring passwords: 3
The detail can be found in <a href="#useraccountanalysis">User information</a>
Number of accounts which can have an empty password (can be overridden by GPO): 1
The detail can be found in <a href="#useraccountanalysis">User information</a> and <a href="#computeraccountanalysis">Computer information</a>

">Object configuration
	Admin control

SIDHistory

Certificate take over

Obsolete OS
	Control paths

Trust impermeability

Golden ticket

<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 2 Score: 15" data-bs-html="true" data-bs-content="
Presence of service accounts without AES support = 2856
The detail can be found in <a href="#useraccountanalysis">User information</a> and <a href="#computeraccountanalysis">Computer information</a>
The LAN Manager Authentication Level allows the use of NTLMv1 or LM.
The detail can be found in <a href="#lsasettings">Security settings</a>

">Old authentication protocols

Delegation Check

Trust inactive

Local group vulnerability

Provisioning
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 3 Score: 20" data-bs-html="true" data-bs-content="
OU without the accidental deletion protection have been found
The detail can be found in <a href="#admindelegation">Delegations</a>
The Recycle Bin is not enabled
The detail can be found in <a href="#domaininformation">Domain Information</a>
The group Schema Admins is not empty: 1 account(s)
The detail can be found in <a href="#admingroups">Admin Groups</a>

">Irreversible change

Trust with Entra
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 4 Score: 10" data-bs-html="true" data-bs-content="
Authenticated Users can create DNS records
No GPO has been found which disables LLMNR or at least one GPO does enable it explicitly
The detail can be found in <a href="#lsasettings">Security settings</a>
A LDAP authentication without signature enforcement was allowed
Hardened Paths have been modified to lower the security level
The detail can be found in the <a href="#HardenedPaths">Hardened Paths configuration</a> section.

">Network sniffing

Replication
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 1 Score: 15" data-bs-html="true" data-bs-content="
Number of privileges granted by GPO to any user: 1
The detail can be found in <a href="#gpoprivileges">Privileges</a>

">Privilege control
		<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 3 Score: 35" data-bs-html="true" data-bs-content="
RPC interfaces of DC


_raw:
Inactive user or computer
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 2 Score: 30" data-bs-html="true" data-bs-content="
Number of admins not in Protected Users: 24
The detail can be found in <a href="#admingroups">Admin Groups</a>
Presence of Admin accounts which do not have the flag "This account is sensitive and cannot be delegated": 24
The detail can be found in <a href="#admingroups">Admin Groups</a>

">Account take over

Old trust protocol
	<div class="div_model" placement="auto right" data-bs-toggle="popover" title="Rules: 2 Score: 10" data-bs-html="true" data-bs-content="
The PowerShell audit configuration is not fully enabled.
The detail can be found in <a href="#lsasettings">Security settings</a>
The audit policy on domain controllers does not collect key events.
The detail can be found in <a href="#auditsettings">Audit settings</a>


_raw: Stale Objects	Privileged accounts	Trusts	Anomalies


_raw: Left-click on the headlines in the boxes for more details


_raw: <div class="col-md-2 col-xs-4 col-sm-3 collapse-group">


_raw: It is about specific security control points


_raw: <div class="col-md-6 col-xs-8 col-sm-9">


_raw: <div class="col-md-4 col-xs-8 col-sm-9">


_raw: <div class="col-xs-12 col-md-6 col-sm-6">


_raw: It is about administrators of the Active Directory


_raw: It is about connections between two Active Directories


_raw: It is about operations related to user or computer objects


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: Informations not listed here are not sent to PingCastle


_raw:
the license
This allows licensed customer to not transmit their domain identifier.


_raw:
Rules ID that matched
This is to present expected or non expected rules.


_raw:
The domain score and maturity level
This is to compare with similar domain.


_raw:
The number of active users & active computers
This is to compare with similar domain size.


_raw:
Report generation date
This is to remove duplicates.


_raw:
for the free license, the hash of the domain FQDN combined with the SID of the domain
The goal is to compute the number of domains reported, without duplicates. The SID act as a salt to prohibit retrieving the original data by bruteforce.


_raw:
IP Address
The goal is to compute country statistics and provide protection against database poisoning.


_raw: The information collected depends on the license level.


_raw: To produce the statistics page, PingCastle will collect anonymous information in order to build this database.


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal" tabindex="-1" role="dialog" id="privacyNoticeStatistics" >


_raw:
Domain Risk Level: 100 / 100

It is the maximum score of the 4 indicators and one score cannot be higher than 100. The lower the better


_raw:
This section focuses on the core security indicators.
Locate the sub-process determining the score and fix some rules in that area to get a score improvement.


_raw: <div class="card-body collapse show" id="panelsectionActiveDirectoryIndicators">


_raw: <!-- Section Active Directory Indicators -->


_raw: If you are an auditor, you MUST purchase an Auditor license to share the development effort.</div>


_raw: Being part of a commercial package is forbidden (selling the information contained in the report).


_raw: This report has been generated with the Basic Edition of PingCastle <i class="info-mark d-print-none" data-bs-placement="bottom" data-bs-toggle="tooltip" title="" data-bs-original-title="Free Edition of PingCastle - Not for commercial use"></i>.


_raw: <div class="d-flex justify-content-between align-items-center report-header">


_raw: PingCastle reports work best with Javascript enabled.


_raw: <div id="wrapper" class="container well">


_raw: <button type="button" class="btn btn-primary" data-bs-dismiss="modal">Close</button>


_raw: Font-Awesome licensed under the MIT license


_raw: Popper.js licensed under the MIT license


_raw: Fody Costura licensed under the MIT license


_raw: Bootstrap Table licensed under the MIT license


_raw: Bootstrap licensed under the MIT license


_raw: <input class='form-check-input' type='checkbox' value='' id='optionExpand'>


_raw: <input class='form-check-input' type='checkbox' value='' id='optionPagination'>


_raw: <input class='form-check-input' type='checkbox' value='' id='optionWideScreen'>


_raw: Generated by Netwrix PingCastle all rights reserved


_raw: <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>


_raw: <div class="modal" id="modalAbout" role="dialog">


_raw: <a class="nav-link p-3" href="#" role="button">


_raw: <div class="collapse navbar-collapse" id="navbarToggler">


_raw: <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarToggler" aria-controls="navbarToggler" aria-expanded="false" aria-label="Toggle navigation">


_raw: <a href="#" class="navbar-brand brand-logo">


_raw: <nav class="navbar py-0 navbar-expand-lg navbar-custom fixed-top border-bottom">


_raw: .legend_unknown {background: #ffffff; border: #a352cc;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_gpo {background: #ad8533; border: #403100;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_ou {background: #cccccc; border: #333333;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_group {background: #70db70; border: #196419;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_computer {background: #d65c33; border: #661a00;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_fsp {background: #ffa366; border: #8f3900;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: .legend_user {background: #80b2ff; border: #0047b2;border-width: 1px;border-style: solid;font-family: monospace;padding:2px;}


_raw: * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)


_raw: * Font Awesome Free 6.0.0 by @fontawesome - https://fontawesome.com


_raw: z-index: 1050; /* Higher z-index to appear above other elements */


_raw: .show > .btn-default.dropdown-toggle:focus {


_raw: display: inline-block; /* required for webkit browsers */


_raw: transition: color 0.3s, border-color 0.3s;


_raw: /* no transition to be used in the carto mode */


_raw: border-top-right-radius: calc(0.3rem - 1px);


_raw: border-top-left-radius: calc(0.3rem - 1px);


_raw:
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <!-- The above 3 meta tags *must* come first in the head; any other head content must come *after* these tags -->
    <meta name="description" content="PingCastle report">
    <meta name="author" content="PingCastle">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'sha256-t+xSDjAl7us/fSDwXMOUEX9O//OSNHhrky8hNs6bz6Q=' 'sha256-h+34cx/xpluAJ76qVjjni3os1cv0h5VLSGEvWSmjkYs=' 'sha256-CH0uenxDr8JF+9hdg3C0QTuYiyd0NwAiTG/x52M3PCk=' 'sha256-2p+csRyNakdkpVpD/radLwmuQZvpIY5bmkCQr5KMqq8=' 'sha256-9PQp/VAjiv1cnX5UR+yatxeJroTsH248dc+N6gXqRFc=' 'sha256-vGrCRkYPwv1G/K8Y22/y1aWwBVPXBwFkF5KYwVutiJI=' 'sha256-/8fqLraRdIdyW7ZjTUeJ7qGK+dLdgAO41mTiD55jCPQ='  'unsafe-inline'; style-src 'sha256-E9PYAbZ2xRLgOf3rB5f6VpHnWkNn/h/OgqRUt5xwYrA=' 'sha256-lox79Yfn7OPDiZBy8kM6/sn3tmULLHsY/fz8/1jhU+A=' 'sha256-9wTWyIscHWckIWA+d5cGD6lLTPy0ar2RrI6QG7mJTtE=' 'sha256-katG0lxebm6sHvlcFSv3acj23y8edwCy1xHxm/ePL/k=' 'sha256-VoIgiAEn7N4CmeA9rm5zEs03X+3Wm5q60Uc4+X09cQs=' 'sha256-LrXughdGvKTFLzNEq7jvbMovwiEmhh1P/QmjOK+Zsjc=' 'sha256-gqXp9G5vs5UKYNen6WnqeLKCsJKcnIiIpjfzwgqasUU='  'unsafe-inline'; object-src 'none'; base-uri https://www.pingcastle.com ; img-src data: https://www.pingcastle.com;"/>
<title>allports.local PingCastle 2025-11-08</title><link href="data:image/x-icon;base64,[encoded data, 9912 characters]
@charset "UTF-8";/*!
 * Bootstrap v5.1.3 (https://getbootstrap.com/)
 * Copyright 2011-2021 The Bootstrap Authors
 * Copyright 2011-2021 Twitter, Inc.
 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
 */:root{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-rgb:220,53,69;--bs-light-rgb:248,249,250;--bs-dark-rgb:33,37,41;--bs-white-rgb:255,255,255;--bs-black-rgb:0,0,0;--bs-body-color-rgb:33,37,41;--bs-body-bg-rgb:255,255,255;--bs-font-sans-serif:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans","Liberation Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--bs-font-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;--bs-gradient:linear-gradient(180deg, rgba(255, 255, 255, 0.15), rgba(255, 255, 255, 0));--bs-body-font-family:var(--bs-font-sans-serif);--bs-body-font-size:1rem;--bs-body-font-weight:400;--bs-body-line-height:1.5;--bs-body-color:#212529;--bs-body-bg:#fff}*,::after,::before{box-sizing:border-box}@media (prefers-reduced-motion:no-preference){:root{scroll-behavior:smooth}}body{margin:0;font-family:var(--bs-body-font-family);font-size:var(--bs-body-font-size);font-weight:var(--bs-body-font-weight);line-height:var(--bs-body-line-height);color:var(--bs-body-color);text-align:var(--bs-body-text-align);background-color:var(--bs-body-bg);-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:transparent}hr{margin:1rem 0;color:inherit;background-color:currentColor;border:0;opacity:.25}hr:not([size]){height:1px}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:.5rem;font-weight:500;line-height:1.2}.h1,h1{font-size:calc(1.375rem + 1.5vw)}@media (min-width:1200px){.h1,h1{font-size:2.5rem}}.h2,h2{font-size:calc(1.325rem + .9vw)}@media (min-width:1200px){.h2,h2{font-size:2rem}}.h3,h3{font-size:calc(1.3rem + .6vw)}@media (min-width:1200px){.h3,h3{font-size:1.75rem}}.h4,h4{font-size:calc(1.275rem + .3vw)}@media (min-width:1200px){.h4,h4{font-size:1.5rem}}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}p{margin-top:0;margin-bottom:1rem}abbr[data-bs-original-title],abbr[title]{-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;-webkit-text-decoration-skip-ink:none;text-decoration-skip-ink:none}address{margin-bottom:1rem;font-style:normal;line-height:inherit}ol,ul{padding-left:2rem}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}.small,small{font-size:.875em}.mark,mark{padding:.2em;background-color:#fcf8e3}sub,sup{position:relative;font-size:.75em;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:#0d6efd;text-decoration:underline}a:hover{color:#0a58ca}a:not([href]):not([class]),a:not([href]):not([class]):hover{color:inherit;text-decoration:none}code,kbd,pre,samp{font-family:var(--bs-font-monospace);font-size:1em;direction:ltr;unicode-bidi:bidi-override}pre{display:block;margin-top:0;margin-bottom:1rem;overflow:auto;font-size:.875em}pre code{font-size:inherit;color:inherit;word-break:normal}code{font-size:.875em;color:#d63384;word-wrap:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:.875em;color:#fff;background-color:#212529;border-radius:.2rem}kbd kbd{padding:0;font-size:1em;font-weight:700}figure{margin:0 0 1rem}img,svg{vertical-align:middle}table{caption-side:bottom;border-collapse:collapse}caption{padding-top:.5rem;padding-bottom:.5rem;color:#6c757d;text-align:left}th{text-align:inherit;text-align:-webkit-match-parent}tbody,td,tfoot,th,thead,tr{border-color:inherit;border-style:solid;border-width:0}label{display:inline-block}button{border-radius:0}button:focus:not(:focus-visible){outline:0}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,select{text-transform:none}[role=button]{cursor:pointer}select{word-wrap:normal}select:disabled{opacity:1}[list]::-webkit-calendar-picker-indicator{display:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]:not(:disabled),[type=reset]:not(:disabled),[type=submit]:not(:disabled),button:not(:disabled){cursor:pointer}::-moz-focus-inner{padding:0;border-style:none}textarea{resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{float:left;width:100%;padding:0;margin-bottom:.5rem;font-size:calc(1.275rem + .3vw);line-height:inherit}@media (min-width:1200px){legend{font-size:1.5rem}}legend+*{clear:left}::-webkit-datetime-edit-day-field,::-webkit-datetime-edit-fields-wrapper,::-webkit-datetime-edit-hour-field,::-webkit-datetime-edit-minute,::-webkit-datetime-edit-month-field,::-webkit-datetime-edit-text,::-webkit-datetime-edit-year-field{padding:0}::-webkit-inner-spin-button{height:auto}[type=search]{outline-offset:-2px;-webkit-appearance:textfield}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-color-swatch-wrapper{padding:0}::-webkit-file-upload-button{font:inherit}::file-selector-button{font:inherit}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}output{display:inline-block}iframe{border:0}summary{display:list-item;cursor:pointer}progress{vertical-align:baseline}[hidden]{display:none!important}.lead{font-size:1.25rem;font-weight:300}.display-1{font-size:calc(1.625rem + 4.5vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-1{font-size:5rem}}.display-2{font-size:calc(1.575rem + 3.9vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-2{font-size:4.5rem}}.display-3{font-size:calc(1.525rem + 3.3vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-3{font-size:4rem}}.display-4{font-size:calc(1.475rem + 2.7vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-4{font-size:3.5rem}}.display-5{font-size:calc(1.425rem + 2.1vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-5{font-size:3rem}}.display-6{font-size:calc(1.375rem + 1.5vw);font-weight:300;line-height:1.2}@media (min-width:1200px){.display-6{font-size:2.5rem}}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:.5rem}.initialism{font-size:.875em;text-transform:uppercase}.blockquote{margin-bottom:1rem;font-size:1.25rem}.blockquote>:last-child{margin-bottom:0}.blockquote-footer{margin-top:-1rem;margin-bottom:1rem;font-size:.875em;color:#6c757d}.blockquote-footer::before{content:"— "}.img-fluid{max-width:100%;height:auto}.img-thumbnail{padding:.25rem;background-color:#fff;border:1px solid #dee2e6;border-radius:.25rem;max-width:100%;height:auto}.figure{display:inline-block}.figure-img{margin-bottom:.5rem;line-height:1}.figure-caption{font-size:.875em;color:#6c757d}.container,.container-fluid,.container-lg,.container-md,.container-sm,.container-xl,.container-xxl{width:100%;padding-right:var(--bs-gutter-x,.75rem);padding-left:var(--bs-gutter-x,.75rem);margin-right:auto;margin-left:auto}@media (min-width:576px){.container,.container-sm{max-width:540px}}@media (min-width:768px){.container,.container-md,.container-sm{max-width:720px}}@media (min-width:992px){.container,.container-lg,.container-md,.container-sm{max-width:960px}}@media (min-width:1200px){.container,.container-lg,.container-md,.container-sm,.container-xl{max-width:1140px}}@media (min-width:1400px){.container,.container-lg,.container-md,.container-sm,.container-xl,.container-xxl{max-width:1320px}}.row{--bs-gutter-x:1.5rem;--bs-gutter-y:0;display:flex;flex-wrap:wrap;margin-top:calc(-1 * var(--bs-gutter-y));margin-right:calc(-.5 * var(--bs-gutter-x));margin-left:calc(-.5 * var(--bs-gutter-x))}.row>*{flex-shrink:0;width:100%;max-width:100%;padding-right:calc(var(--bs-gutter-x) * .5);padding-left:calc(var(--bs-gutter-x) * .5);margin-top:var(--bs-gutter-y)}.col{flex:1 0 0%}.row-cols-auto>*{flex:0 0 auto;width:auto}.row-cols-1>*{flex:0 0 auto;width:100%}.row-cols-2>*{flex:0 0 auto;width:50%}.row-cols-3>*{flex:0 0 auto;width:33.3333333333%}.row-cols-4>*{flex:0 0 auto;width:25%}.row-cols-5>*{flex:0 0 auto;width:20%}.row-cols-6>*{flex:0 0 auto;width:16.6666666667%}.col-auto{flex:0 0 auto;width:auto}.col-1{flex:0 0 auto;width:8.33333333%}.col-2{flex:0 0 auto;width:16.66666667%}.col-3{flex:0 0 auto;width:25%}.col-4{flex:0 0 auto;width:33.33333333%}.col-5{flex:0 0 auto;width:41.66666667%}.col-6{flex:0 0 auto;width:50%}.col-7{flex:0 0 auto;width:58.33333333%}.col-8{flex:0 0 auto;width:66.66666667%}.col-9{flex:0 0 auto;width:75%}.col-10{flex:0 0 auto;width:83.33333333%}.col-11{flex:0 0 auto;width:91.66666667%}.col-12{flex:0 0 auto;width:100%}.offset-1{margin-left:8.33333333%}.offset-2{margin-left:16.66666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.33333333%}.offset-5{margin-left:41.66666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.33333333%}.offset-8{margin-left:66.66666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.33333333%}.offset-11{margin-left:91.66666667%}.g-0,.gx-0{--bs-gutter-x:0}.g-0,.gy-0{--bs-gutter-y:0}.g-1,.gx-1{--bs-gutter-x:0.25rem}.g-1,.gy-1{--bs-gutter-y:0.25rem}.g-2,.gx-2{--bs-gutter-x:0.5rem}.g-2,.gy-2{--bs-gutter-y:0.5rem}.g-3,.gx-3{--bs-gutter-x:1rem}.g-3,.gy-3{--bs-gutter-y:1rem}.g-4,.gx-4{--bs-gutter-x:1.5rem}.g-4,.gy-4{--bs-gutter-y:1.5rem}.g-5,.gx-5{--bs-gutter-x:3rem}.g-5,.gy-5{--bs-gutter-y:3rem}@media (min-width:576px){.col-sm{flex:
/*# sourceMappingURL=bootstrap.min.css.map */
</style>
<style type="text/css">
/**
  * bootstrap-table - An extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation)
  *
  * @version v1.19.1
  * @homepage https://bootstrap-table.com
  * @author wenzhixin <REDACTED_EMAIL> (http://wenzhixin.net.cn/)
  * @license MIT
  */
.bootstrap-table .fixed-table-toolbar::after{content:"";display:block;clear:both}.bootstrap-table .fixed-table-toolbar .bs-bars,.bootstrap-table .fixed-table-toolbar .columns,.bootstrap-table .fixed-table-toolbar .search{position:relative;margin-top:10px;margin-bottom:10px}.bootstrap-table .fixed-table-toolbar .columns .btn-group>.btn-group{display:inline-block;margin-left:-1px!important}.bootstrap-table .fixed-table-toolbar .columns .btn-group>.btn-group>.btn{border-radius:0}.bootstrap-table .fixed-table-toolbar .columns .btn-group>.btn-group:first-child>.btn{border-top-left-radius:4px;border-bottom-left-radius:4px}.bootstrap-table .fixed-table-toolbar .columns .btn-group>.btn-group:last-child>.btn{border-top-right-radius:4px;border-bottom-right-radius:4px}.bootstrap-table .fixed-table-toolbar .columns .dropdown-menu{text-align:left;max-height:300px;overflow:auto;-ms-overflow-style:scrollbar;z-index:1001}.bootstrap-table .fixed-table-toolbar .columns label{display:block;padding:3px 20px;clear:both;font-weight:400;line-height:1.428571429}.bootstrap-table .fixed-table-toolbar .columns-left{margin-right:5px}.bootstrap-table .fixed-table-toolbar .columns-right{margin-left:5px}.bootstrap-table .fixed-table-toolbar .pull-right .dropdown-menu{right:0;left:auto}.bootstrap-table .fixed-table-container{position:relative;clear:both}.bootstrap-table .fixed-table-container .table{width:100%;margin-bottom:0!important}.bootstrap-table .fixed-table-container .table td,.bootstrap-table .fixed-table-container .table th{vertical-align:middle;box-sizing:border-box}.bootstrap-table .fixed-table-container .table thead th{vertical-align:bottom;padding:0;margin:0}.bootstrap-table .fixed-table-container .table thead th:focus{outline:0 solid transparent}.bootstrap-table .fixed-table-container .table thead th.detail{width:30px}.bootstrap-table .fixed-table-container .table thead th .th-inner{padding:.75rem;vertical-align:bottom;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.bootstrap-table .fixed-table-container .table thead th .sortable{cursor:pointer;background-position:right;background-repeat:no-repeat;padding-right:30px!important}.bootstrap-table .fixed-table-container .table thead th .both{background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABMAAAATCAQAAADYWf5HAAAAkElEQVQoz7X QMQ5AQBCF4dWQSJxC5wwax1Cq1e7BAdxD5SL+Tq/QCM1oNiJidwox0355mXnG/DrEtIQ6azioNZQxI0ykPhTQIwhCR+BmBYtlK7kLJYwWCcJA9M4qdrZrd8pPjZWPtOqdRQy320YSV17OatFC4euts6z39GYMKRPCTKY9UnPQ6P+GtMRfGtPnBCiqhAeJPmkqAAAAAElFTkSuQmCC")}.bootstrap-table .fixed-table-container .table thead th .asc{background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABMAAAATCAYAAAByUDbMAAAAZ0lEQVQ4y2NgGLKgquEuFxBPAGI2ahhWCsS/gDibUoO0gPgxEP8H4ttArEyuQYxAPBdqEAxPBImTY5gjEL9DM+wTENuQahAvEO9DMwiGdwAxOymGJQLxTyD+jgWDxCMZRsEoGAVoAADeemwtPcZI2wAAAABJRU5ErkJggg==")}.bootstrap-table .fixed-table-container .table thead th .desc{background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABMAAAATCAYAAAByUDbMAAAAZUlEQVQ4y2NgGAWjYBSggaqGu5FA/BOIv2PBIPFEUgxjB+IdQPwfC94HxLykus4GiD+hGfQOiB3J8SojEE9EM2wuSJzcsFMG4ttQgx4DsRalkZENxL+AuJQaMcsGxBOAmGvopk8AVz1sLZgg0bsAAAAASUVORK5CYII= ")}.bootstrap-table .fixed-table-container .table tbody tr.selected td{background-color:rgba(0,0,0,.075)}.bootstrap-table .fixed-table-container .table tbody tr.no-records-found td{text-align:center}.bootstrap-table .fixed-table-container .table tbody tr .card-view{display:flex}.bootstrap-table .fixed-table-container .table tbody tr .card-view .card-view-title{font-weight:700;display:inline-block;min-width:30%;width:auto!important;text-align:left!important}.bootstrap-table .fixed-table-container .table tbody tr .card-view .card-view-value{width:100%!important}.bootstrap-table .fixed-table-container .table .bs-checkbox{text-align:center}.bootstrap-table .fixed-table-container .table .bs-checkbox label{margin-bottom:0}.bootstrap-table .fixed-table-container .table .bs-checkbox label input[type=checkbox],.bootstrap-table .fixed-table-container .table .bs-checkbox label input[type=radio]{margin:0 auto!important}.bootstrap-table .fixed-table-container .table.table-sm .th-inner{padding:.3rem}.bootstrap-table .fixed-table-container.fixed-height:not(.has-footer){border-bottom:1px solid #dee2e6}.bootstrap-table .fixed-table-container.fixed-height.has-card-view{border-top:1px solid #dee2e6;border-bottom:1px solid #dee2e6}.bootstrap-table .fixed-table-container.fixed-height .fixed-table-border{border-left:1px solid #dee2e6;border-right:1px solid #dee2e6}.bootstrap-table .fixed-table-container.fixed-height .table thead th{border-bottom:1px solid #dee2e6}.bootstrap-table .fixed-table-container.fixed-height .table-dark thead th{border-bottom:1px solid #32383e}.bootstrap-table .fixed-table-container .fixed-table-header{overflow:hidden}.bootstrap-table .fixed-table-container .fixed-table-body{overflow-x:auto;overflow-y:auto;height:100%}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading{align-items:center;background:#fff;display:flex;justify-content:center;position:absolute;bottom:0;width:100%;max-width:100%;z-index:1000;transition:visibility 0s,opacity .15s ease-in-out;opacity:0;visibility:hidden}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading.open{visibility:visible;opacity:1}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap{align-items:baseline;display:flex;justify-content:center}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .loading-text{margin-right:6px}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-wrap{align-items:center;display:flex;justify-content:center}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-dot,.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-wrap::after,.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-wrap::before{content:"";animation-duration:1.5s;animation-iteration-count:infinite;animation-name:LOADING;background:#212529;border-radius:50%;display:block;height:5px;margin:0 4px;opacity:0;width:5px}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-dot{animation-delay:.3s}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading .loading-wrap .animation-wrap::after{animation-delay:.6s}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading.table-dark{background:#212529}.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading.table-dark .animation-dot,.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading.table-dark .animation-wrap::after,.bootstrap-table .fixed-table-container .fixed-table-body .fixed-table-loading.table-dark .animation-wrap::before{background:#fff}.bootstrap-table .fixed-table-container .fixed-table-footer{overflow:hidden}.bootstrap-table .fixed-table-pagination::after{content:"";display:block;clear:both}.bootstrap-table .fixed-table-pagination>.pagination,.bootstrap-table .fixed-table-pagination>.pagination-detail{margin-top:10px;margin-bottom:10px}.bootstrap-table .fixed-table-pagination>.pagination-detail .pagination-info{line-height:34px;margin-right:5px}.bootstrap-table .fixed-table-pagination>.pagination-detail .page-list{display:inline-block}.bootstrap-table .fixed-table-pagination>.pagination-detail .page-list .btn-group{position:relative;display:inline-block;vertical-align:middle}.bootstrap-table .fixed-table-pagination>.pagination-detail .page-list .btn-group .dropdown-menu{margin-bottom:0}.bootstrap-table .fixed-table-pagination>.pagination ul.pagination{margin:0}.bootstrap-table .fixed-table-pagination>.pagination ul.pagination li.page-intermediate a{color:#c8c8c8}.bootstrap-table .fixed-table-pagination>.pagination ul.pagination li.page-intermediate a::before{content:'\2B05'}.bootstrap-table .fixed-table-pagination>.pagination ul.pagination li.page-intermediate a::after{content:'\27A1'}.bootstrap-table .fixed-table-pagination>.pagination ul.pagination li.disabled a{pointer-events:none;cursor:default}.bootstrap-table.fullscreen{position:fixed;top:0;left:0;z-index:1050;width:100%!important;background:#fff;height:calc(100vh);overflow-y:scroll}.bootstrap-table.bootstrap4 .pagination-lg .page-link,.bootstrap-table.bootstrap5 .pagination-lg .page-link{padding:.5rem 1rem}.bootstrap-table.bootstrap5 .float-left{float:left}.bootstrap-table.bootstrap5 .float-right{float:right}div.fixed-table-scroll-inner{width:100%;height:200px}div.fixed-table-scroll-outer{top:0;left:0;visibility:hidden;width:200px;height:150px;overflow:hidden}@keyframes LOADING{0%{opacity:0}50%{opacity:1}to{opacity:0}}
</style>
<style type="text/css">
body {
    background: #e1e1e1;
    height: 100%;
    min-height: 100%;
}
html {
    height: 100%;
    min-height: 100%;
}
strong{
    font-weight: 400;
}
a {
    color: #0068DA;
    text-decoration: none !important;
}
.btn-secondary {
    color: #5E666E;
    background-color:#fff;
    border-color:#E0E5EB;
}
    .btn-secondary:hover {
        background-color: #0d6efd;
    }
.alert-info {
    color: #171a1d;
    background-color: #E5F2FF;
    border: none;
}
.bar {
    fill: #77A9E3;
}
.alert{
    position: relative;
    padding: 1rem 1rem;
    margin-bottom: 1rem;
    border-radius: 0.25rem
}
.text-white {
    --bs-text-opacity: 1;
    color: #171a1d !important;
}
.report-header{
    margin-top:20px;
}
.report-date{
    font-size:20px;
}
.notif {
    border-radius: var(--border-radius-sm, 2px);
    border-left: 4px solid var(--color-semantic-info, #0F82FF);
    background: var(--color-semantic-info-light, #E5F2FF);
}
.warn {
    display: inline-block;
    border-radius: var(--border-radius-sm, 2px);
    border-left: 4px solid var(--color-semantic-info, #FFC700);
    background: var(--color-semantic-info-light, #FFF9E5);
    padding: 1em;
}
.tooltip .border-flag {
    border: 1px solid #000;
    border-radius: 3px;
    padding: 2px 4px;
}
.fw-bold {
    font-weight: 400 !important;
}
.h1, .h2, .h3, .h4, .h5, .h6, h1, h2, h3, h4, h5, h6{
    margin-top:0;
    margin-bottom: 1.25rem;
    font-weight: 400;
    line-height:1.2;
}
.sub-section {
    font-size: 24px;
    display: flex;
}
.risk-sub-section{
    margin-top:40px;
}
.submit-btn {
    margin-bottom: 10px;
    color: #0068DA !important;
    border-color: #0068DA !important;
}
    .submit-btn:hover {
        margin-bottom: 10px;
        color: #fff !important;
        border-color: #fff !important;
        background-color: #0068DA !important;
    }
.sectionheader {
    color: #000000 !important;
    text-decoration: underline !important;
    font-weight: 500
}
@media (min-width: 1200px) {
    .h1, h1{
        font-size: 2.5rem
    }
}
@media screen {
    body {
        padding-top: 50px;
        margin-top: 10px;
    }
    h1, h2, h3, h4 {
        color: #171a1d;
    }
    a {
        color: #006BDA;
        text-decoration: underline;
    }
        a:hover {
            color: #58595b;
        }
}
@media print {
    .card {
        border: none;
    }
    .card-header {
        border: none;
    }
    .navbar {
        display: none;
    }
    .container {
        max-width: initial;
    }
    .bootstrap-table .fixed-table-toolbar {
        display: none;
    }
    .sectionheader {
        color: rgb(250, 156, 26);
        text-decoration: none;
    }
    table {
        table-layout: fixed;
        width: 100%;
        height: 100%;
    }
}
#wrapper {
    box-shadow: 0 0 8px rgba(0,0,0,0.25);
}
    #wrapper.well {
        background: #fff;
        border-radius: 0;
    }
.ticked {
    color: #4CAF50;
}
.unticked {
    color: #FF1744;
}
.navbar-custom {
    background-color: #ffffff;
    display: flex;
    padding-left: var(--spacing-500, 40px);
    align-items: center;
    gap: 30px;
}
    .navbar-custom .navbar-toggler-icon {
        background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E");
    }
    .navbar-custom .navbar-toggler {
        color: rgba(0, 0, 0, 0.5);
        border-color: rgba(0, 0, 0, 0.1);
    }
    /* change the brand and text color */
    .navbar-custom .navbar-brand, .navbar-custom .navbar-text {
        color: #fa9c1a;
    }
    /* change the link color */
    .navbar-custom .navbar-nav .nav-link {
        color: #171a1d;
    }
    .navbar-custom .navbar-nav > .active > a,
    .navbar-custom .navbar-nav > .active > a:hover,
    .navbar-custom .navbar-nav > .active > a:focus {
        border-bottom:4px solid #D22730
    }
.nav-tabs .nav-link {
    border-color: #e9ecef #e9ecef #dee2e6;
    color: #58595b;
}
    .nav-tabs .nav-link:hover {
        border-color: #e9ecef #e9ecef #dee2e6;
        background-color: #0068DA14;
    }
.nav-tabs .nav-link.disabled {
    color: #6c757d;
    background-color: transparent;
    border-color: transparent;
}
    .nav-tabs .nav-link.active,
    .nav-tabs .nav-item.show .nav-link {
        color: #171a1d;
        font-weight: 500;
    }
/* navbar */
.navbar-brand {
    margin: 0;
    padding: 0;
}
    .navbar-brand img {
        max-height: 100%;
    }
.dropdown-item.active, .dropdown-item:active {
    background-color: #0068DA;
}
.risk_model_none {
    background-color: #00AAFF;
    padding: 5px;
    border: 1px solid;
}
.risk_model_low {
    background-color: #ffd800;
    padding: 5px;
    border: 1px solid;
}
.risk_model_medium {
    background-color: #ff6a00;
    padding: 5px;


_raw:
allports.local
About
Healthcheck analysis
Date: 2025-11-08 - Engine version: 3.4.2.66
This report has been generated with the Basic Edition of PingCastle .
Being part of a commercial package is forbidden (selling the information contained in the report).
If you are an auditor, you MUST purchase an Auditor license to share the development effort.
Active Directory Indicators
This section focuses on the core security indicators.
Locate the sub-process determining the score and fix some rules in that area to get a score improvement.
Indicators
0
50
100
Domain Risk Level: 100 / 100
It is the maximum score of the 4 indicators and one score cannot be higher than 100. The lower the better
Privacy notice
0
50
100
Stale Object : 46 /100
It is about operations related to user or computer objects
12 rules matched
0
50
100
Trusts : 0 /100
It is about connections between two Active Directories
0 rules matched
0
50
100
Privileged Accounts : 95 /100
It is about administrators of the Active Directory
8 rules matched
0
50
100
Anomalies : 100 /100
It is about specific security control points
19 rules matched
Risk model
Left-click on the headlines in the boxes for more details
Stale Objects	Privileged accounts	Trusts	Anomalies
Inactive user or computer
Account take over
Old trust protocol
Audit
Network topography
ACL Check
SID Filtering
Backup
Object configuration
Admin control
SIDHistory
Certificate take over
Obsolete OS
Control paths
Trust impermeability
Golden ticket
Old authentication protocols
Delegation Check
Trust inactive
Local group vulnerability
Provisioning
Irreversible change
Trust with Entra
Network sniffing
Replication
Privilege control
Pass-the-credential
Vulnerability management
Read-Only Domain Controllers
Password retrieval
Reconnaissance
Temporary admins
Weak password
Legend:
  score is 0 - no risk identified
  score is 0 - no risk identified but some improvements detected
  score between 1 and 10 - a few actions have been identified
  score between 10 and 30 - rules should be looked with attention
  score higher than 30 - major risks identified
Maturity Level
This section represents the maturity score (inspired from ANSSI).
This feature is reserved for customers who have purchased a license
MITRE ATT&CK®
This section represents an evaluation of the techniques available in the MITRE ATT&CK®
This feature is reserved for customers who have purchased a license
Stale Objects
0
50
100
Stale Objects : 46 /100
It is about operations related to user or computer objects
Stale Objects rule details [12 rules matched on a total of 56]
 + 15 Point(s)
 + 15 Point(s)
 + 10 Point(s)
 + 5 Point(s)
 + 1 Point(s)
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
Privileged Accounts
0
50
100
Privileged Accounts : 95 /100
It is about administrators of the Active Directory
Privileged Accounts rule details [8 rules matched on a total of 46]
 + 30 Point(s)
 + 20 Point(s)
 + 15 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 Informative rule
 Informative rule
Trusts
0
50
100
Trusts : 0 /100
It is about links between two Active Directories
Trusts rule details [0 rules matched on a total of 12]
No rule matched
Anomalies analysis
0
50
100
Anomalies : 100 /100
It is about specific security control points
Anomalies rule details [19 rules matched on a total of 73]
 + 15 Point(s)
 + 15 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 + 10 Point(s)
 + 5 Point(s)
 + 5 Point(s)
 + 5 Point(s)
 + 5 Point(s)
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
 Informative rule
Domain Information
This section shows the main technical characteristics of the domain.
Domain	Netbios Name	Domain Functional Level	Forest Functional Level	Creation date	DC count	Schema version	Recycle Bin enabled


_raw: C:\Users\Guest\Desktop\New folder(11/8/2025 5:54:25 PM)


_raw: ┌──(pentester㉿cptc11-regional-southeast-t7-vdi-kali03)-[~/Tools/NTLM_reflection]                                                                                └─$ nxc smb 10.0.1.21 -u adiaz11 -p 'Sails@way!' --shares -k                                                                                SMB         10.0.1.21       445    DECKHAND-02      [*] Windows Server 2022 Build 20348 x64 (name:DECKHAND-02) (domain:allports.local) (signing:False) (SMBv1:None)                                                                        SMB         10.0.1.21       445    DECKHAND-02      [+] allports.local\adiaz11:Sails@way!                                                                                SMB         10.0.1.21       445    DECKHAND-02      [*] Enumerated shares                                                                                SMB         10.0.1.21       445    DECKHAND-02      Share           Permissions     Remark                                                                                SMB         10.0.1.21       445    DECKHAND-02      -----           -----------     ------                                                                                SMB         10.0.1.21       445    DECKHAND-02      ADMIN$                          Remote Admin                                                                                SMB         10.0.1.21       445    DECKHAND-02      C$                              Default share                                                                                SMB         10.0.1.21       445    DECKHAND-02      Galley          READ,WRITE                                                                                SMB         10.0.1.21       445    DECKHAND-02      IPC$            READ            Remote IPC


_raw:
    Modified: 11/8/2025 5:44:06 PM
   =================================================================================================
╚ Follow the provided link for further instructions in how to decrypt the masterkey.
╔══════════╣ Checking for DPAPI Credential Files
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    CredFile: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
    Description: Local Credential Data
    MasterKey: bb79b120-6cc4-4368-9389-480bc37cbe9b


_raw:
Logon Time        : 11/8/2025 5:44:01 PM
SID               : S-1-5-21-2288084429-921088559-2964959546-501
         * Username : Guest
         * Domain   : DECKHAND-01
         * Password : (null)
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 2834970 (00000000:002b421a)
Session           : Service from 0
User Name         : SplunkForwarder
Domain            : NT SERVICE
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 5:44:01 PM
SID               : S-1-5-21-2288084429-921088559-2964959546-501
        msv :
         [00000003] Primary
         * Username : Guest
         * Domain   : DECKHAND-01
         * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0
         * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709
        tspkg :
        wdigest :
         * Username : Guest
         * Domain   : DECKHAND-01
         * Password : (null)
        kerberos :
         * Username : Guest
         * Domain   : DECKHAND-01
         * Password : (null)
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 2834970 (00000000:002b421a)
Session           : Service from 0
User Name         : SplunkForwarder
Domain            : NT SERVICE
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 5:43:01 PM
SID               : S-1-5-96-0-2
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 5:43:01 PM
SID               : S-1-5-90-0-2
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        Group 0 - Ticket Granting Service
        Group 1 - Client Ticket ?
        Group 2 - Ticket Granting Ticket
Authentication Id : 0 ; 146611879 (00000000:08bd1ea7)
Session           : RemoteInteractive from 3
User Name         : cloudbase-init
Domain            : DECKHAND-01
Logon Server      : DECKHAND-01


_raw:
Logon Time        : 11/8/2025 5:43:01 PM
SID               : S-1-5-96-0-2
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)


_raw:
Logon Time        : 11/8/2025 5:43:01 PM
SID               : S-1-5-90-0-2
        msv :
         [00000003] Primary
         * Username : DECKHAND-01$
         * Domain   : APT
         * NTLM     : c570efd16c93e73595446cb2c2875273
         * SHA1     : d1d83600fc13c80b90fc80a09cb665c2dbb722a8
        tspkg :
        wdigest :
         * Username : DECKHAND-01$
         * Domain   : APT
         * Password : (null)
        kerberos :
         * Username : DECKHAND-01$
         * Domain   : allports.local
         * Password : ]Y(OfS2su9pp7q&Z^ZOGTeF(V>G=a@FXzC!^%KY"v!>u.c5/UN:@kafoFnge22+CgVA=5vN[i07I$b`?#1>"!oBLHl!!C`BW>^`7?4C6uqF7=IacDwX*WKK`
        ssp :
        credman :
        cloudap :
Authentication Id : 0 ; 146611879 (00000000:08bd1ea7)
Session           : RemoteInteractive from 3
User Name         : cloudbase-init
Domain            : DECKHAND-01
Logon Server      : DECKHAND-01


_raw:
# echo_tcp.ps1
$port = 9000                         # change port
$addr = [System.Net.IPAddress]::Any  # use 127.0.0.1 for local-only
$listener = [System.Net.Sockets.TcpListener]::new($addr, $port)
$listener.Start()
Write-Host "Listening on port $port. Waiting for one connection..."
$client = $listener.AcceptTcpClient()
$stream = $client.GetStream()
$reader = New-Object System.IO.StreamReader($stream)
$writer = New-Object System.IO.StreamWriter($stream)
$writer.AutoFlush = $true
while (($line = $reader.ReadLine()) -ne $null) {
    Write-Host "Received: $line"
    $writer.WriteLine("ECHO: $line")
}
$writer.Close(); $reader.Close()
$client.Close()
$listener.Stop()
Write-Host "Done."


_raw: nxc ldap $ip -u $user -p $password --users-export output.txt


_raw: lastlogoff                                   samaccountname


_raw: 'S-1-5-21-890171859-3433809279-3366196753-1114', 'CN=dfm,CN=Users,DC=testlab,DC=local','4c435dd7-dc58-4b14-9a5e-1fdb0e80d201','administrator' | Get-DomainUser -Properties samaccountname,lastlogoff


_raw: Return the user with the given SID, as well as Administrator.


_raw: Return all users for the testlab.local domain


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Switch. Return user accounts with "Do not require Kerberos preauthentication" set.


_raw: Switch. Return computer objects that are trusted to authenticate for other principals.


_raw: Switch. Return user accounts that are marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return users with '(adminCount=1)' (meaning are/were privileged).


_raw: "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'.


_raw: Dynamic parameter that accepts one or more values from $UACEnum, including


_raw: Switch. Only return user objects with non-null service principal names.


_raw: Wildcards accepted. Also accepts DOMAIN\user format.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: "-Properties samaccountname,usnchanged,...". By default, all user objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-ADName, Convert-LDAPProperty


_raw: Return all users or specific user objects in AD.


_raw: # "net *" replacements and other fun start below


_raw: $Out | Add-Member Noteproperty 'Value' $Object.$ObjectProperty


_raw: $Out | Add-Member Noteproperty 'Property' $ObjectProperty


_raw: $Out | Add-Member Noteproperty 'SamAccountName' $Object.SamAccountName


_raw: if ($ReferenceObjectProperties -NotContains $ObjectProperty) {


_raw: ForEach($ObjectProperty in $ObjectProperties) {


_raw: $ObjectProperties = Get-Member -InputObject $Object -MemberType NoteProperty | Select-Object -Expand Name


_raw: throw "[Find-DomainObjectPropertyOutlier] Invalid class: $ClassName"


_raw: $Objects = Get-DomainComputer @SearcherArguments


_raw: elseif (($ClassName -eq 'Computer') -or ($ReferenceObjectClass -eq 'Computer')) {


_raw: $Objects = Get-DomainGroup @SearcherArguments


_raw: elseif (($ClassName -eq 'Group') -or ($ReferenceObjectClass -eq 'Group')) {


_raw: $Objects = Get-DomainUser @SearcherArguments


_raw: if (($ClassName -eq 'User') -or ($ReferenceObjectClass -eq 'User')) {


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Using the default reference property set for the object class '$ClassName'"


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Calculated ReferenceObjectClass : $ReferenceObjectClass"


_raw: $ReferenceObjectClass = $ReferenceObject.objectclass | Select-Object -Last 1


_raw: $ReferenceObjectProperties = Get-Member -InputObject $ReferenceObject -MemberType NoteProperty | Select-Object -Expand Name


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Extracting property names from -ReferenceObject to use as the reference property set"


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Using specified -ReferencePropertySet"


_raw: if ($PSBoundParameters['Credential']) { $SchemaArguments['Credential'] = $Credential }


_raw: Write-Verbose "[Find-DomainObjectPropertyOutlier] Enumerated forest '$TargetForest' for target domain '$Domain'"


_raw: $TargetForest = Get-Domain -Domain $Domain -Credential $Credential | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name


_raw: $TargetForest = Get-Domain -Domain $Domain | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(ValueFromPipeline = $True, Mandatory = $True, ParameterSetName = 'ReferenceObject')]


_raw: [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ClassName')]


_raw: Custom PSObject with translated object property outliers.


_raw: Enumerates computers in the current domain with 'outlier' properties filled in.


_raw: Get-DomainComputer -FindOne | Find-DomainObjectPropertyOutlier


_raw: Enumerates groups in the external.local forest/domain with 'outlier' properties filled in.


_raw: Find-DomainObjectPropertyOutlier -ClassName 'Group' -Domain external.local


_raw: Enumerates users in the current domain with 'outlier' properties filled in.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Specicifes the PowerView user/group/computer object to extract property names


_raw: Specifies an array of property names to diff against the class schema.


_raw: If -ReferenceObject is specified, this will be automatically extracted, if possible.


_raw: Specifies the AD object class to find property outliers for, 'user', 'group', or 'computer'.


_raw: samAccountName, property name, and property value are output to the pipeline.


_raw: 'non-standard' property set (meaning a property not held by the reference set), the object's


_raw: (depending on determined class) are enumerated, and for each object, if the object has a


_raw: from the property names of the passed -ReferenceObject. Every user/group/computer object


_raw: for user/group/computers, or from the array of names passed to -ReferencePropertySet, or


_raw: A 'reference' set of property names is calculated, either from a standard set preserved


_raw: Required Dependencies: Get-Domain, Get-DomainUser, Get-DomainGroup, Get-DomainComputer


_raw: Author: Will Schroeder (@harmj0y), Matthew Graeber (@mattifestation)


_raw: Finds user/group/computer objects in AD that have 'outlier' properties set.


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: An ActiveDirectorySchemaClass returned from the found schema.


_raw: Returns the user schema class for the external.local domain using


_raw: Get-ForestSchemaClass -ClassName user -Forest external.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the user schema class for the external.local domain.


_raw: Get-ForestSchemaClass -ClassName user -Forest external.local


_raw: Returns all domain schema classes for the external.local forest.


_raw: Returns all domain schema classes for the current forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The forest to query for the schema, defaults to the current forest.


_raw: Specifies a ActiveDirectorySchemaClass name in the found schema to return.


_raw: result for the specified class name is returned.


_raw: If "-FindClass X" is specified, the [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass]


_raw: the .FindAllClasses() method is executed, returning a collection of


_raw: Uses Get-Forest to retrieve the current (or specified) forest. By default,


_raw: (or specified) forest or returns just the schema class specified by


_raw: Helper that returns the Active Directory schema classes for the current


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Specifies the forest name to query for global catalogs.


_raw: and the .FindAllGlobalCatalogs() to enumerate the global catalogs.


_raw: by -Forest X by using Get-Forest to retrieve the specified forest object


_raw: Returns all global catalogs for the current forest or the forest specified


_raw: Return all global catalogs for the current (or specified) forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the forest name to query for domains.


_raw: Returns all domains for the current forest or the forest specified


_raw: Return all domains for the current (or specified) forest.


_raw: $ForestObject | Add-Member NoteProperty 'RootDomainSid' $ForestSid


_raw: $ForestSid = $Parts[0..$($Parts.length-2)] -join '-'


_raw: $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name).objectsid


_raw: $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name -Credential $Credential).objectsid


_raw: Write-Verbose "[Get-Forest] The specified forest '$Forest' does not exist, could not be contacted, or there isn't an existing trust: $_"


_raw: $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest)


_raw: Write-Verbose "[Get-Forest] The specified forest '$TargetForest' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"


_raw: $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $TargetForest, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "[Get-Forest] Extracted domain '$Forest' from -Credential"


_raw: # if no domain is supplied, extract the logon domain from the PSCredential passed


_raw: Write-Verbose "[Get-Forest] Using alternate credentials for Get-Forest"


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: Outputs a PSObject containing System.DirectoryServices.ActiveDirectory.Forest in addition


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The forest name to query for, defaults to the current forest.


_raw: forest or the forest specified with -Forest X.


_raw: Returns a System.DirectoryServices.ActiveDirectory.Forest object for the current


_raw: Returns the forest object for the current (or specified) forest.


_raw: # UAC specification for domain controllers


_raw: if ($PSBoundParameters['Server']) { $Arguments['Server'] = $Server }


_raw: if ($PSBoundParameters['LDAP'] -or $PSBoundParameters['Server']) {


_raw: if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $Arguments['Domain'] = $Domain }


_raw: Outputs custom PSObjects with details about the enumerated domain controller if -LDAP is specified.


_raw: Determine the domain controllers for 'test.local'.


_raw: Determine the domain controllers for 'test.local' using LDAP queries.


_raw: Get-DomainController -Domain 'test.local' -LDAP


_raw: Switch. Use LDAP queries to determine the domain controllers instead of built in .NET methods.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The domain to query for domain controllers, defaults to the current domain.


_raw: By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer


_raw: Enumerates the domain controllers for the current or specified domain.


_raw: Required Dependencies: Get-DomainComputer, Get-Domain


_raw: Return the domain controllers for the current (or specified) domain.


_raw: Write-Verbose "[Get-Domain] Error retrieving the current domain: $_"


_raw: Write-Verbose "[Get-Domain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_"


_raw: $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)


_raw: Write-Verbose "[Get-Domain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"


_raw: $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "[Get-Domain] Extracted domain '$TargetDomain' from -Credential"


_raw: # if no domain is supplied, extract the logon domain from the PSCredential passed


_raw: Write-Verbose '[Get-Domain] Using alternate credentials for Get-Domain'


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain name to query for, defaults to the current domain.


_raw: domain or the domain specified with -Domain X.


_raw: Returns a System.DirectoryServices.ActiveDirectory.Domain object for the current


_raw: Returns the domain object for the current (or specified) domain.


_raw: Write-Verbose "[Get-DomainDNSRecord] Error disposing of the Results object: $_"


_raw: Write-Warning "[Get-DomainDNSRecord] Error: $_"


_raw: $Out | Add-Member NoteProperty $_.Name $_.Value


_raw: $Record.PSObject.Properties | ForEach-Object {


_raw: $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord


_raw: $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord[0]


_raw: # TODO: handle multiple nested records properly?


_raw: if ($Out.dnsrecord -is [System.DirectoryServices.ResultPropertyValueCollection]) {


_raw: # convert the record and extract the properties


_raw: $Out | Add-Member NoteProperty 'ZoneName' $ZoneName


_raw: $Out = Convert-LDAPProperty -Properties $_.Properties | Select-Object name,distinguishedname,dnsrecord,whencreated,whenchanged


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $DNSSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher.FindOne() }


_raw: $DNSSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0,  Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs custom PSObjects with detailed information about the DNS record entry.


_raw: Retrieve all records for all zones in the dev.testlab.local domain.


_raw: Get-DomainDNSZone -Domain dev.testlab.local | Get-DomainDNSRecord -Domain dev.testlab.local


_raw: Retrieve all records for all zones in the current domain.


_raw: Retrieve all records for the testlab.local zone.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an Active Directory server (domain controller) to bind to for the search.


_raw: The domain to query for zones, defaults to the current domain.


_raw: Specifies the zone to query for records (which can be enumearted with Get-DomainDNSZone).


_raw: and use Convert-DNSRecord to try to convert the binary DNS record blobs.


_raw: LDAP entries using that zone as the search base. Return all DNS entry results


_raw: Given a specific Active Directory DNS zone name, query for all 'dnsNode'


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-DNSRecord


_raw: Enumerates the Active Directory DNS records for a given zone.


_raw: Write-Verbose "[Get-DomainDNSZone] Error accessing 'CN=MicrosoftDNS,DC=DomainDnsZones'"


_raw: Write-Verbose "[Get-DomainDNSZone] Error disposing of the Results object: $_"


_raw: $Out | Add-Member NoteProperty 'ZoneName' $Out.name


_raw: $Out = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $DNSSearcher2.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher2.FindOne() }


_raw: $DNSSearcher2 = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_"


_raw: else { $Results = $DNSSearcher1.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher1.FindOne()  }


_raw: $DNSSearcher1 = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True)]


_raw: Outputs custom PSObjects with detailed information about the DNS zone.


_raw: Retrieves the DNS zones for the dev.testlab.local domain, binding to primary.testlab.local.


_raw: Get-DomainDNSZone -Domain dev.testlab.local -Server primary.testlab.local


_raw: Retrieves the DNS zones for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an Active Directory server (domain controller) to bind to for the search.


_raw: The domain to query for zones, defaults to the current domain.


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Enumerates the Active Directory DNS zones for a given domain.


_raw: $DNSRecordObject | Add-Member Noteproperty 'Data' $Data


_raw: $DNSRecordObject | Add-Member Noteproperty 'TimeStamp' $TimeStamp


_raw: $DNSRecordObject | Add-Member Noteproperty 'Age' $Age


_raw: $DNSRecordObject | Add-Member Noteproperty 'TTL' $TTL


_raw: $DNSRecordObject | Add-Member Noteproperty 'UpdatedAtSerial' $UpdatedAtSerial


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'UNKNOWN'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SRV'


_raw: # TODO: how to implement properly? nested object?


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'AAAA'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'TXT'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'MX'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'HINFO'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'PTR'


_raw: $Ptr = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SOA'


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'CNAME'


_raw: $Alias = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'NS'


_raw: $NSName = Get-Name $DNSRecord[24..$DNSRecord.length]


_raw: $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'A'


_raw: $TimeStamp = ((Get-Date -Year 1601 -Month 1 -Day 1 -Hour 0 -Minute 0 -Second 0).AddHours($age)).ToString()


_raw: $Age = [BitConverter]::ToUInt32($DNSRecord, 20)


_raw: $TTL = [BitConverter]::ToUInt32($TTLRaw, 0)


_raw: $UpdatedAtSerial = [BitConverter]::ToUInt32($DNSRecord, 8)


_raw: $RDataType = [BitConverter]::ToUInt16($DNSRecord, 2)


_raw: # $RDataLen = [BitConverter]::ToUInt16($DNSRecord, 0)