Identity and Security Technology Blogs

GPOOutline – The Shape of Your Group Policy

noreply@blogger.com (Blog-5) — Mon, 17 Aug 2026 15:58:54 +0000

GPOOutline – Group Policy Object (GPO) Documentation Tool

A practical, read-only PowerShell tool for documenting Group Policy across an Active Directory forest

GitHub: github.com/SanthoshSivarajan/GPOOutline

GPOOutline – self-contained Group Policy documentation report

Group Policy has been part of Active Directory environments for decades, but in many organizations it remains one of the least documented areas of the infrastructure.

Administrators may know individual GPOs and where some policies are linked, but getting a complete picture of how Group Policy is configured across an entire forest can still be difficult. Group Policy information lives in both Active Directory and SYSVOL, and understanding the environment requires bringing those pieces together.

That is the reason I created GPOOutline.

GPOOutline is a single-file, read-only PowerShell tool that documents how Group Policy is configured across an Active Directory forest and produces one self-contained HTML report. The goal is simple: show what is configured today, how it is connected, where it applies, and what the environment actually looks like.

Why GPOOutline?

Group Policy settings are spread across directory objects, SYSVOL files, links, filters, permissions, WMI filters, scripts, preferences, and inheritance rules. Looking at one GPO at a time does not always answer the broader operational questions.

GPOOutline is designed to help answer questions such as:

· What GPOs exist across the forest?

· Where is each GPO linked?

· What applies to a particular OU?

· Which policy wins when multiple GPOs configure the same setting?

· Where is inheritance blocked or a link enforced?

· Which GPOs are unlinked, empty, disabled, or otherwise have little runtime effect?

· Who can edit or delegate a GPO?

· What WMI filters, scripts, preferences, and client-side extensions are being used?

· Are AD and SYSVOL versions consistent?

· What Group Policy information should be understood before consolidation, migration, audit, or handover?

Design Philosophy

GPOOutline was intentionally built to keep collection simple, transparent, and portable.

It is a single PowerShell script. There is no installer, agent, database, RSAT requirement, GPMC requirement, ActiveDirectory module requirement, or GroupPolicy module requirement for normal collection. The tool reads Group Policy metadata through LDAP and reads policy configuration from SYSVOL. It does not modify Active Directory or SYSVOL.

The output is a self-contained HTML report that can be opened offline, plus a JSON state file that can be used to regenerate the report without touching the directory again.

GPOOutline collection running from PowerShell

What GPOOutline Records

1. Forest and Domain Context

The report starts with environment context, including forest and domain information, functional levels, domain controllers, PDC emulators, sites, trusts, SYSVOL replication method, and Central ADMX Store status. This provides the background needed to understand the Group Policy configuration that follows.

2. GPO Inventory and Scope of Management

GPOOutline provides a high-level inventory of the Group Policy environment, including GPO counts, links, enabled and disabled states, enforced links, and other scope-related information. This gives you a quick view before you move into individual GPOs.

GPO inventory and scope of management

3. Every GPO in Detail

Each GPO can be reviewed in detail, including identity, domain, GUID, timestamps, status, AD and SYSVOL versions, links, link order, enforcement, security filtering, delegation, WMI filters, client-side extensions, comments, and evidence paths. This helps reduce the need to move between several management interfaces just to understand one GPO.

Detailed GPO inventory and configuration view

4. Group Policy Settings

GPOOutline reads and documents the major Group Policy setting areas, including Administrative Templates, security settings, audit policy, scripts, software installation, folder redirection, and Group Policy Preferences. Administrative Template registry settings can be decoded and, where available, resolved to ADMX-friendly names.

5. OU Tree, Links, and Scope

Understanding a GPO by itself is only part of the story. GPOOutline builds an OU-based view so you can see where policies are linked, how link order is configured, where inheritance is blocked, and where enforced links affect processing.

OU tree with GPO links and inheritance context

6. Resultant Precedence

When multiple GPOs configure overlapping settings, the important question is which setting ultimately wins. GPOOutline computes resultant precedence using the normal Group Policy processing model, including site, domain, OU layering, nested OUs, link order, block inheritance, and enforced links.

Resultant Group Policy precedence by container

7. Loopback, Site Links, and Anomalies

Loopback processing can make Group Policy troubleshooting difficult, especially in RDS, Citrix, kiosk, shared-device, and administrative workstation scenarios. GPOOutline identifies loopback mode and scope. It also calls out site-linked GPOs and configuration anomalies such as unlinked, empty, disabled, mismatched, missing, or unreachable policy objects.

Loopback processing, site-linked GPOs, and orphan/anomaly views

8. Cross-Reference Mapping

Cross-reference views make it easier to answer both directions of the relationship: where is this GPO used, and which GPOs affect this container? GPOOutline provides GPO-to-container and container-to-GPO views to make those relationships easier to navigate.

GPO-to-container and container-to-GPO mapping

9. WMI Filters and Client-Side Extensions

GPOOutline identifies WMI filter usage and the client-side extensions used across the environment. This is useful for documentation, troubleshooting, consolidation, and understanding which processing components are actually in use.

WMI filter usage and client-side extension inventory

10. Behavior and Runtime Impact

The report also provides visibility into behavior-related areas such as processing characteristics, setting footprint, tattooing indicators, and GPOs that appear to have no runtime effect. These are documentation signals, not automatic recommendations to remove anything.

Tattooing indicators and GPOs with no runtime effect

What GPOOutline Does Not Do

GPOOutline is intentionally a documentation tool, not an assessment engine. It does not provide risk scoring, grades, health scores, traffic-light ratings, automatic remediation advice, endpoint scanning, or configuration changes. It records the current state and leaves interpretation and remediation decisions to an assessment or a human reviewer.

Common Use Cases

· Active Directory and Group Policy documentation

· Assessment preparation

· GPO consolidation and cleanup planning

· Intune migration discovery and planning

· Mergers and acquisitions

· Active Directory migration

· Audit and compliance documentation

· Operational handover and knowledge transfer

· Troubleshooting scope, inheritance, filtering, precedence, and loopback

Requirements

· Windows PowerShell 5.1 or PowerShell 7.x

· Domain-joined Windows system, or another Windows host with line of sight to a domain controller when -Server and -Credential are used

· LDAP connectivity to a domain controller

· SMB access to SYSVOL for full setting collection

· Write access to the output folder

· No RSAT, GPMC, local administrator rights, or WinRM required for normal collection

Port	Service	Purpose
389/TCP	LDAP	Directory collection
88/TCP	Kerberos	Authentication
445/TCP	SMB	SYSVOL parsing

How to Use GPOOutline – Step by Step

Step 1 – Download the Tool

Download or clone the repository from: https://github.com/SanthoshSivarajan/GPOOutline

The primary script is GPOOutline.ps1. Copy it to a management workstation, jump box, or other Windows system that can reach the target Active Directory environment.

Step 2 – Open PowerShell

Open PowerShell and change to the folder containing the script.

cd C:\Tools\GPOOutline

Step 3 – Run a Standard Forest-Wide Collection

From a domain-joined system, the simplest run is:

.\GPOOutline.ps1

The script discovers the environment, validates connectivity, and begins collection. The console shows progress through the different collection phases.

Step 4 – Review the Output Files

A normal run creates three primary files:

GPOOutline_<forest>_<stamp>.html
GPOOutline_<forest>_<stamp>.state.json
GPOOutline_<stamp>.log

· HTML report – the self-contained report you open in a browser.

· State JSON – the complete collected dataset used to regenerate the report without reconnecting to AD.

· Log file – structured collection details useful for troubleshooting and validation.

Step 5 – Open the HTML Report

Open the generated HTML file in a browser. The report is self-contained and does not require a web server, database, or connection back to Active Directory.

Additional Usage Examples

Run from a non-domain-joined machine:

.\GPOOutline.ps1 -Server dc01.contoso.com -Credential (Get-Credential)

Scope to specific domains and choose an output folder:

.\GPOOutline.ps1 -Domain corp.contoso.com,emea.contoso.com -OutputPath C:\Reports

Limit collection to an OU subtree:

.\GPOOutline.ps1 -SearchBase "OU=Europe,DC=contoso,DC=com"

Preview the size of the collection before running it:

.\GPOOutline.ps1 -WhatIfScope

Perform a fast metadata-only pass without SYSVOL setting collection:

.\GPOOutline.ps1 -SkipSysvol

Reduce concurrency for a busy environment:

.\GPOOutline.ps1 -MaxConcurrency 4 -ThrottleDelayMs 50

Regenerate the HTML report from a previously collected state file without touching Active Directory:

.\GPOOutline.ps1 -FromState .\GPOOutline_contoso_com_20260816_141500.state.json

Useful Parameters

Parameter	Purpose
-Server	Target domain controller or domain
-Credential	Alternate credentials; useful for non-domain-joined collection
-Domain	Limit collection to selected domains
-SearchBase	Limit OU/link collection to a subtree
-OutputPath	Choose output directory
-MaxConcurrency	Control parallel SYSVOL workers
-ThrottleDelayMs	Add delay between batches
-SkipSysvol	Metadata-only collection
-IncludeSites	Include site-linked GPOs
-ResolveAdmx	Resolve ADMX-friendly names
-WhatIfScope	Preview the collection work list
-FromState	Regenerate from an existing state file
-NoHtml / -NoState	Suppress one of the normal outputs
-ExcludeDC	Do not contact selected domain controllers
-ShowDetail	Show additional console detail

Where GPOOutline Fits in the Tool Family

I use four related tool families, each answering a different question:

Series	Question
Outline	What is configured right now?
Atlas	How is it structured, and what connects to what?
Canvas	What does it mean, and where should I look?
Lens	What changed since last time?

GPOOutline belongs to the Outline series. Its purpose is current-state documentation without scoring or remediation recommendations. ADOutline is the closest sibling for documenting the broader Active Directory forest. GPOLens is planned as a separate interpretation layer for Group Policy modernization and Intune migration scenarios.

More of My Work

· GitHub – all tools and repositories

· GPOOutline

· ADOutline

· ITUserGroup Community

· SAG Business Group

· Personal Website

· Technical Blog

· LinkedIn

· Microsoft MVP Profile

Download GPOOutline

GPOOutline is available here: https://github.com/SanthoshSivarajan/GPOOutline

If you work with Active Directory and Group Policy, give it a try and review the report in your own environment. Feedback, testing, issue reports, and community contributions are always welcome.

“If someone asked you today to show them exactly how Group Policy is configured across your environment, could you?”

GPOOutline is designed to help you answer that question.

ADOutline - Active Directory Documentation Tool

noreply@blogger.com (Blog-5) — Sun, 09 Aug 2026 14:12:30 +0000

ADOutline

Automated Active Directory Documentation for the Hybrid Identity Era

ADOutline: Active Directory Documentation Tool

ADOutline answers a simple but important question: What is actually configured in Active Directory right now? It is designed to document the current state, not to score, grade, or remediate the environment.

Active Directory environments often evolve over many years through upgrades, migrations, mergers, application integrations, administrator turnover, and infrastructure refreshes. The result is usually not a lack of knowledge, but fragmented knowledge spread across different teams, consoles, scripts, diagrams, and historical documents.

ADOutline turns that distributed configuration into a repeatable, point-in-time documentation package. It reads Active Directory and related domain-controller configuration, then produces a structured, self-contained HTML report that can be reviewed, archived, shared with engineering teams, attached to tickets, or retained as a baseline for future comparison.

At a Glance	Details
Purpose	Current-state Active Directory documentation
Delivery model	Single PowerShell script; no module installation
Report	Self-contained HTML report with structured navigation
Coverage	47 report sections and 11 interactive diagrams
Primary collection	LDAP, SYSVOL/SMB, and optional CIM/DCOM to domain controllers
Data handling	Read-only collection; no external upload required
Typical uses	Discovery, modernization, audit preparation, handover, DR, consulting, M&A

Note: I originally published Active Directory documentation utilities and guidance through portal.sivarajan.com. ADOutline is the relaunch and modernization of that work for today’s identity environment. The goal is still simple: make Active Directory documentation easier, repeatable, and useful. But the environment around AD has changed. The new ADOutline therefore extends the documentation beyond traditional on-premises Active Directory and can surface signals associated with Microsoft Entra Connect, Okta, Ping, SailPoint, JumpCloud, Duo, Google Cloud Identity, and AD FS when evidence is present.

Download ADOutline

ADOutline is open source and available on GitHub.
https://github.com/SanthoshSivarajan/ADOutline

Direct ZIP download:
https://github.com/SanthoshSivarajan/ADOutline/archive/refs/heads/main.zip

Figure 1 - ADOutline landing page and report navigation. The report is a self-contained HTML document with a structured left-side index.

Why Active Directory Documentation Still Matters

Active Directory remains foundational to authentication, authorization, server access, application dependencies, Group Policy, DNS, PKI, and many hybrid identity designs. Yet the configuration is often distributed across years of changes, migrations, mergers, administrator turnover, and infrastructure refreshes.

The operational problem is rarely that no one knows anything about the directory. The problem is that knowledge is fragmented. A domain administrator may know the domain controllers, another engineer may know the trusts, a cloud team may know Microsoft Entra Connect, and a security team may know the privileged-access model. What is usually missing is one repeatable, point-in-time document that brings those facts together.

ADOutline is intended to fill that gap by collecting the configured state and rendering it into a readable report that can be archived, handed to another team, attached to a ticket, used during a migration, or retained as a baseline.

· Create a current architecture baseline before a migration, upgrade, or redesign.

· Document an acquired or inherited forest before consolidation or separation work begins.

· Provide a factual handover package to another team, MSP, or owner.

· Support audit preparation with a repeatable record instead of relying on tribal knowledge.

· Preserve a known-good architectural reference for disaster recovery and tabletop exercises.

· Reduce time spent manually assembling discovery data during consulting engagements.

What ADOutline Is - and What It Is Not

ADOutline is	ADOutline is not
Current-state documentation	A security assessment
Read-only data collection	A remediation engine
A single self-contained HTML report	A cloud-hosted reporting service
A point-in-time record of configuration	A scorecard or maturity rating
A documentation and handover aid	A replacement for engineering judgment

The distinction is deliberate: ADOutline records the facts. If you want a visual map, ADAtlas is intended to help you see the environment; if you want health analysis, ADCanvas is intended to help you understand the environment.

A Relaunch for the Hybrid Identity Era

This project is not a disconnected new utility. It is the next generation of the Active Directory documentation work I previously shared through portal.sivarajan.com. The original focus was the on-premises directory. That remains the foundation, but modern identity architecture now includes synchronization, federation, SaaS identity providers, MFA platforms, identity governance, and other services connected to AD.

That is why the relaunched ADOutline broadens the documentation model. When directory evidence is available, the report can surface signals associated with Microsoft Entra Connect, Okta, Ping, SailPoint, JumpCloud, Duo, Google Cloud Identity, and AD FS. The objective is not to claim complete configuration knowledge of every external product; it is to document the identity ecosystem that Active Directory appears to participate in.

Free Open-Source Tools for Identity, Security, Microsoft 365, Intune, Defender, and Active Directory

noreply@blogger.com (Blog-5) — Sun, 09 Aug 2026 14:08:29 +0000

Free Open-Source Tools for Identity, Security, Microsoft 365, Intune, Defender, and Active Directory

One of the most practical ways to contribute to a technical community is to turn repeatable technical knowledge into tools that other professionals can use.

That is the philosophy behind the growing collection of free and open-source tools available through the SAG Business Group Technical Community.

The community currently organizes many of these projects into two complementary families:

Canvas — Assessment, Reporting & Analysis

Atlas — Mapping, Structure & Visualization

The full Community and Tools page is available here:

https://www.sagbusinessgroup.com/community.html

Why Community Tools Matter

Modern enterprise identity and security platforms can become extremely complex.

An organization may operate:

· Active Directory

· Microsoft Entra ID

· Microsoft 365

· Microsoft Defender

· Microsoft Intune

· Hybrid Identity

· PKI

· Hundreds of applications

· Thousands of users and devices

· Privileged accounts

· Service accounts

· Managed identities

· Other non-human identities

Understanding those environments often means gathering information from many different consoles, APIs, scripts, and configuration locations.

Free community tools can help automate that process.

The Canvas Tool Suite

The Canvas Tool Suite focuses on assessment, reporting, and analysis.

ADCanvas — Active Directory

ADCanvas provides Active Directory reporting and analysis across areas such as forests, domains, domain controllers, objects, trusts, Group Policy, and replication.

Project:

https://github.com/SanthoshSivarajan/ADCanvas

EntraIDCanvas — Microsoft Entra ID

EntraIDCanvas creates Microsoft Entra ID documentation and reporting covering users, groups, applications, enterprise applications, Conditional Access, roles, devices, and other tenant information.

Project:

https://github.com/SanthoshSivarajan/EntraIDCanvas

M365Canvas — Microsoft 365

M365Canvas covers Microsoft 365 services including Exchange Online, SharePoint, OneDrive, Teams, security configuration, DLP, and sensitivity labels.

Project:

https://github.com/SanthoshSivarajan/M365Canvas

DefenderCanvas — Microsoft Defender

DefenderCanvas focuses on the Microsoft Defender ecosystem, including Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, security configuration, and threat policies.

Project:

https://github.com/SanthoshSivarajan/DefenderCanvas

IntuneCanvas — Microsoft Intune

IntuneCanvas focuses on device policies, compliance, application deployment, configuration profiles, and enrollment across Microsoft Intune environments.

Project:

https://github.com/SanthoshSivarajan/IntuneCanvas

ZeroTrustCanvas — Zero Trust

ZeroTrustCanvas examines Zero Trust across Identity, Devices, Network, Applications, Data, Infrastructure, and related frameworks.

Project:

https://github.com/SanthoshSivarajan/ZeroTrustCanvas

NHICanvas — Non-Human Identities

NHICanvas focuses on an increasingly important part of modern IAM: non-human identities.

Coverage includes service accounts, managed identities, application registrations, and service principals.

Project:

https://github.com/SanthoshSivarajan/NHICanvas

DelegationCanvas — Active Directory Delegation

DelegationCanvas maps Active Directory permissions, ACLs, and OU delegation to make complex delegated-access relationships easier to understand.

Project:

https://github.com/SanthoshSivarajan/DelegationCanvas

AttackPathCanvas — Identity Attack Paths

AttackPathCanvas focuses on identity attack paths involving privilege escalation, lateral movement, and credential exposure in Active Directory.

Project:

https://github.com/SanthoshSivarajan/AttackPathCanvas

The Atlas Tool Series

The Atlas Tool Series serves a different purpose.

Rather than assessment and analysis, Atlas tools focus on creating point-in-time structural maps of identity and infrastructure systems.

ADAtlas

Maps Active Directory forests, domains, sites, trusts, and supporting services.

https://github.com/SanthoshSivarajan/ADAtlas

EntraAtlas

Maps Microsoft Entra ID tenants, identities, roles, applications, and access relationships.

https://github.com/SanthoshSivarajan/EntraAtlas

M365Atlas

Maps Microsoft 365 services including Exchange Online, SharePoint, OneDrive, Teams, and service configuration.

https://github.com/SanthoshSivarajan/M365Atlas

DefenderAtlas

Maps the Microsoft Defender ecosystem across Endpoint, Identity, Office 365, Cloud Apps, security configuration, and coverage.

https://github.com/SanthoshSivarajan/DefenderAtlas

IntuneAtlas

Maps Microsoft Intune device configuration, compliance policies, application deployments, and enrollment structures.

https://github.com/SanthoshSivarajan/IntuneAtlas

PKIAtlas

Maps Active Directory Certificate Services, including Certificate Authorities, templates, trust stores, and issuance structure.

https://github.com/SanthoshSivarajan/PKIAtlas

IdentityAtlas

IdentityAtlas provides a broader structural view across on-premises and cloud identity systems, showing identities, roles, systems, and relationships.

https://github.com/SanthoshSivarajan/IdentityAtlas

Canvas and Atlas Answer Different Questions

A simple way to understand the two families is:

Canvas helps you understand the environment.

Atlas helps you see the environment.

Canvas is primarily intended for assessment, reporting, and analysis.

Atlas focuses on mapping, structure, configuration, and relationships without scoring.

Together, they provide complementary views of modern identity and security environments.

Free and Open Source

The Canvas and Atlas projects are provided as free, open-source software under the MIT License.

There is no subscription requirement to use the tools.

The projects can be reviewed, tested, modified, and used by the technical community.

The complete project portfolio can be accessed from the Community page:

https://www.sagbusinessgroup.com/community.html

Or directly through GitHub:

https://github.com/SanthoshSivarajan

As with any community-provided administrative or assessment script, review the source and test it in a non-production environment before wider use.

More Than Individual Scripts

The larger value of a community tool portfolio is not any individual script.

It is reusable technical knowledge.

Every time a complex environment can be automatically collected, documented, mapped, analyzed, or visualized, another engineer can spend less time gathering information manually and more time understanding the environment.

That is one of the most practical forms of community contribution.

Conclusion

Modern Identity and Security environments are complex, but the tools used to understand them do not always need to be expensive or inaccessible.

Through the Canvas Tool Suite and Atlas Tool Series, the community provides free open-source capabilities spanning Active Directory, Microsoft Entra ID, Microsoft 365, Defender, Intune, Zero Trust, PKI, non-human identities, delegation, attack paths, and cross-platform identity architecture.

The objective is straightforward:

Build useful technical tools, make them freely available, and enable the community to learn from them, use them, improve them, and share knowledge forward.

#OpenSource #OpenSourceTools #IdentitySecurity #IAM #ActiveDirectory #MicrosoftEntra #EntraID #Microsoft365 #MicrosoftDefender #MicrosoftIntune #PowerShell #ZeroTrust #PKI #HybridIdentity #IdentityManagement #CloudSecurity #CyberSecurity #MicrosoftSecurity #IdentityGovernance #TechCommunity

Free Identity and Security Labs, Mentoring, and Community Learning

noreply@blogger.com (Blog-5) — Sun, 09 Aug 2026 14:07:32 +0000

From Theory to Hands-On Experience: Free Identity and Security Labs, Mentoring, and Community Learning

There is an enormous difference between understanding how a technology works and having the opportunity to actually work with it.

You can read about Active Directory replication.

You can study Microsoft Entra Conditional Access.

You can watch a demonstration of PowerShell automation.

You can learn the principles of Hybrid Identity and Zero Trust.

But practical confidence develops when you can build, test, troubleshoot, make mistakes, correct them, and understand how technologies interact inside a realistic environment.

That is why hands-on technical enablement is one of the central components of the SAG Business Group Technical Community.

And it is provided to the community at no cost.

https://www.sagbusinessgroup.com/community.html

Removing the Lab Barrier

Enterprise technology labs can be expensive and difficult to maintain.

A useful identity lab may require:

· Multiple Windows servers

· Active Directory domain controllers

· DNS

· Microsoft Entra ID

· Hybrid Identity

· Cloud subscriptions

· Client systems

· Test identities

· Security configurations

· Applications

· Automation tooling

For someone learning independently, building all of this can become an obstacle before the learning even begins.

The community helps address that problem by maintaining dedicated lab infrastructure.

Lab & Demo Hub

https://labanddemo.com

Additional Lab & Demo Environment

https://mylabanddemo.com

Infrastructure Lab

https://myinfralab.com

These resources are maintained as part of the community’s technical enablement ecosystem.

Enterprise-Style Learning Environments

The objective is not simply to provide virtual machines.

The goal is to give learners exposure to architectures and technologies that resemble what they may encounter in enterprise environments.

Areas of learning include:

· Active Directory

· Microsoft Entra ID

· Hybrid Identity

· Identity and Access Management

· Cloud Identity

· PowerShell

· Security

· Infrastructure

Additional identity-focused resources include:

https://enterpriseidentitysolutions.com

https://virtualidentitysolutions.com

https://hybrididentitysolutions.com

https://identitybridgesolutions.com

A Safe Place to Experiment

Production environments are not training environments.

Administrators cannot freely experiment with domain controllers, authentication, Conditional Access, privileged identities, synchronization, or security controls in production.

A lab gives someone permission to ask:

What happens if I change this?

That question is fundamental to technical learning.

A controlled sandbox allows learners to make changes, observe results, troubleshoot failures, and understand dependencies without putting production systems at risk.

Learning Through Real Scenarios

Good technical learning should teach more than commands.

It should teach reasoning.

A practical identity exercise might involve understanding:

· Why an account cannot authenticate

· Why directory synchronization is not working

· How an Active Directory trust operates

· How group membership changes authorization

· How cloud and on-premises identities relate

· How Conditional Access affects authentication

· How PowerShell can automate administration

· How identity architecture influences security

Scenario-based learning helps bridge the gap between knowing a command and understanding why the technology behaves the way it does.

Technical Mentoring

Infrastructure becomes even more valuable when it is combined with mentoring.

The Technical Community provides monthly in-person and virtual activities focused on technologies such as Active Directory, Microsoft Entra ID, PowerShell automation, and Identity Security.

Mentoring can help professionals asking questions such as:

· How do I get started in IAM?

· How can I move from Active Directory into cloud identity?

· What Entra ID skills should I develop?

· How important is PowerShell for identity professionals?

· How do IAM and cybersecurity intersect?

· What should I learn to become an identity architect?

The emphasis is practical learning and helping participants connect technology concepts to real enterprise environments.

Join the IT User Group

The IT User Group extends this learning through regular community sessions.

Visit:

https://itusergroup.com

Activities include:

· Technical meetups

· Presentations

· Workshops

· Live demonstrations

· Hands-on labs

· Open technical discussions

· Professional networking

Both in-person and virtual participation are available, helping make the community accessible beyond a single geographic location.

Learning Through Peer Experience

One of the most powerful benefits of a technical community is exposure to other people’s experience.

A problem one engineer has never encountered may have been solved by another administrator years ago.

Someone working primarily with Active Directory may learn from a Microsoft Entra specialist.

A PowerShell engineer may help automate a process that another administrator has been performing manually.

An IAM governance professional may bring a completely different perspective to a technical identity discussion.

That exchange of knowledge is difficult to reproduce through documentation alone.

Free Means Free

The Technical Community is structured as a 100% free initiative.

There are:

· No participation fees

· No membership fees

· No subscriptions

· No commercial obligations

The community program, available resources, and current activities can be found at:

https://www.sagbusinessgroup.com/community.html

Conclusion

Technical skills become meaningful when theory is connected to practice.

By combining enterprise-style labs, sandbox environments, mentoring, technical workshops, user-group activities, live demonstrations, collaborative problem solving, and virtual accessibility, the community provides multiple ways for professionals and students to develop practical Identity and Security experience.

And by keeping those opportunities free, the program helps remove one of the biggest barriers to technical growth: access.

The objective is simple — give people a place to learn, a place to practice, and a community where they can continue growing.

#IdentitySecurity #IAM #ActiveDirectory #MicrosoftEntra #EntraID #PowerShell #HybridIdentity #ZeroTrust #CyberSecurity #CloudIdentity #HandsOnLabs #HandsOnLearning #TechnicalTraining #Mentorship #CareerDevelopment #ITCommunity #TechCommunity #MicrosoftSecurity

A Free Technical Community Initiative

noreply@blogger.com (Blog-5) — Sun, 09 Aug 2026 14:05:45 +0000

Building Identity and Security Skills Without Barriers: A Free Technical Community Initiative

Technology continues to evolve rapidly, but access to practical learning opportunities does not always evolve with it.

For professionals and students working in Identity and Access Management, Active Directory, Microsoft Entra ID, PowerShell, Hybrid Identity, Zero Trust, cloud technologies, and cybersecurity, the challenge is often not finding information. The bigger challenge is finding opportunities to apply that information in realistic environments, experiment safely, learn from others, and develop practical skills.

The SAG Business Group Technical Community was created around a simple principle:

Technical learning, mentoring, hands-on resources, and community tools should be accessible without financial barriers.

The entire initiative is available at no cost. There are no membership fees, subscriptions, or commercial obligations.

Learn more about the community initiative:

https://www.sagbusinessgroup.com/community.html

Three Core Areas of Community Support

The community program brings together three major areas:

· Technical Enablement & Mentorship

· Community Engagement

· Free Open-Source Tools

Together, these programs create an environment where professionals can learn, practice, collaborate, and share technical knowledge.

Free Hands-On Lab Environments

One of the biggest challenges in learning enterprise technologies is access to infrastructure.

Building a realistic Active Directory, Microsoft Entra ID, Hybrid Identity, cloud, or security lab can require multiple servers, cloud subscriptions, networking, software, time, and ongoing maintenance.

The community maintains several privately funded environments specifically to support hands-on technical learning.

These include:

Lab & Demo Hub
https://labanddemo.com

Additional Lab & Demo Environment
https://mylabanddemo.com

Infrastructure Lab
https://myinfralab.com

These environments are part of a larger portfolio maintained to support technical learning and experimentation.

The objective is not simply to demonstrate a feature. It is to provide realistic environments where participants can understand architecture, test configurations, troubleshoot problems, and apply technical concepts without introducing risk into a production environment.

Identity-Focused Learning Resources

Identity has become one of the most important areas of modern infrastructure and cybersecurity.

To support deeper learning across traditional, cloud, and hybrid identity technologies, the community also maintains dedicated identity-focused resources.

These include:

https://enterpriseidentitysolutions.com

https://virtualidentitysolutions.com

https://hybrididentitysolutions.com

https://identitybridgesolutions.com

These platforms support the broader goal of making Identity and Access Management knowledge and practical resources accessible to the technical community.

Mentorship and Coaching

Technology skills are not developed through labs and documentation alone.

The community also supports monthly in-person and virtual mentoring focused on practical technologies such as:

· Active Directory

· Microsoft Entra ID

· Identity and Access Management

· PowerShell automation

· Hybrid Identity

· Identity Security

Mentoring is intended to help both students and experienced professionals.

This includes people entering IAM, moving from infrastructure into identity, developing Microsoft Entra skills, learning PowerShell, or expanding into identity architecture and security.

IT User Group: Learning Together

Community learning becomes much more valuable when professionals can exchange experience.

The IT User Group provides regular opportunities for identity and security professionals to participate in:

· Technical presentations

· Workshops

· Live demonstrations

· Hands-on labs

· Hybrid Identity discussions

· Security discussions

· Networking

· Peer-to-peer learning

Both in-person and virtual participation are supported.

Upcoming meetings, sessions, and community activities are available at:

https://itusergroup.com

The objective is not only to deliver presentations but to create an environment where both emerging and experienced professionals can contribute to technical discussions.

Collaborative Problem Solving

Many of the best technical discussions begin with a real-world problem.

The community also supports collaborative technical problem solving around areas such as:

· Active Directory

· Microsoft Entra ID

· Zero Trust

· PowerShell

· Hybrid Identity

· Privileged Access

· Microsoft 365 Security

· Identity Governance

· Incident Response

This helps extend learning beyond scheduled presentations and encourages ongoing knowledge sharing.

Free Open-Source Community Tools

Another major component of the community initiative is a growing collection of free open-source tools.

The tools are primarily organized into two families:

Canvas — Assessment, Reporting & Analysis

Atlas — Mapping, Structure & Visualization

The complete community tools portfolio can be explored here:

https://www.sagbusinessgroup.com/community.html

The open-source projects are also available through GitHub:

https://github.com/SanthoshSivarajan

The tools cover technologies including:

· Active Directory

· Microsoft Entra ID

· Microsoft 365

· Microsoft Defender

· Microsoft Intune

· Zero Trust

· PKI

· Non-Human Identities

· Active Directory delegation

· Identity attack paths

· Cross-platform identity architecture

These projects are free and open source under the MIT License.

Privately Funded Community Infrastructure

Free resources still require infrastructure.

The community currently maintains a portfolio of domains, lab systems, hosting platforms, identity environments, cloud resources, and security resources that are privately funded and made available to support ongoing technical enablement.

Examples include:

https://labanddemo.com
https://mylabanddemo.com
https://myinfralab.com
https://enterpriseidentitysolutions.com
https://virtualidentitysolutions.com
https://hybrididentitysolutions.com
https://identitybridgesolutions.com
https://virtualsecuritysolutions.com
https://sscloudsolutions.com

The full resource portfolio is listed at:

https://www.sagbusinessgroup.com/community.html

No Cost. No Subscription. No Commercial Obligation.

Perhaps the most important part of the community program is what participants are not required to do.

There is no paid membership.

There is no subscription.

There is no requirement to purchase consulting or training services.

The purpose is straightforward:

Share knowledge, provide practical resources, and help strengthen the Identity and Security community.

Conclusion

Closing the technology skills gap requires more than documentation and certification courses. It requires hands-on environments, practical tools, mentoring, community interaction, and opportunities to learn from real-world experience.

By providing free labs, mentoring, user-group activities, collaborative technical support, open-source tools, and privately funded infrastructure, this community initiative is designed to make those opportunities accessible without financial barriers.

Learn. Practice. Share. Build. And help strengthen the Identity and Security community together.

#IdentitySecurity #IAM #IdentityManagement #CyberSecurity #ActiveDirectory #MicrosoftEntra #EntraID #PowerShell #HybridIdentity #ZeroTrust #CloudSecurity #MicrosoftSecurity #ITCommunity #TechCommunity #OpenSource #HandsOnLearning #Mentorship #TechnicalTraining #CyberSecurityCommunity

EntraIDCanvas - Microsoft Entra ID Documentation Tool

noreply@blogger.com (Blog-5) — Fri, 07 Aug 2026 21:43:31 +0000

Introducing EntraIDCanv

ADOutline - Active Directory Documentation Tool for Hybrid Identity Environments

noreply@blogger.com (Blog-5) — Fri, 07 Aug 2026 21:24:40 +0000

Introducing ADOutline: Active Directory Documentation for the Hybrid Identity Era

ADOutline answers a simple but important question: What is actually configured in Active Directory right now? It is designed to document the current state, not to score, grade, or remediate the environment.

I originally published Active Directory documentation utilities and guidance through portal.sivarajan.com. ADOutline is the relaunch and modernization of that work for today’s identity environment. The goal is still simple: make Active Directory documentation easier, repeatable, and useful. But the environment around AD has changed. The new ADOutline therefore extends the documentation beyond traditional on-premises Active Directory and can surface signals associated with Microsoft Entra Connect, Okta, Ping, SailPoint, JumpCloud, Duo, Google Cloud Identity, and AD FS when evidence is present.

Download ADOutline

ADOutline is open source and available on GitHub.
https://github.com/SanthoshSivarajan/ADOutline

Direct ZIP download:
https://github.com/SanthoshSivarajan/ADOutline/archive/refs/heads/main.zip

Figure 1 - ADOutline landing page and report navigation. The report is a self-contained HTML document with a structured left-side index.

Why Active Directory Documentation Still Matters

What ADOutline Is - and What It Is Not

ADOutline is	ADOutline is not
Current-state documentation	A security assessment
Read-only data collection	A remediation engine
A single self-contained HTML report	A cloud-hosted reporting service
A point-in-time record of configuration	A scorecard or maturity rating
A documentation and handover aid	A replacement for engineering judgment

A Relaunch for the Hybrid Identity Era

Figure 2 - Forest and Domain Map showing Microsoft Entra ID / cloud-directory synchronization as part of the hybrid identity picture.

Figure 3 - Example of identity-platform detection in the Forest and Domain Map, here showing Okta alongside the AD forest.

What the Tool Documents

The current ADOutline project describes 47 report sections and 11 interactive diagrams. The exact information available depends on the environment and the collection rights, but the coverage can be grouped into several major areas.

1. Forest, Domains, and Core Directory Configuration

· Forest and domain structure, including domain functional levels and naming contexts.

· Domain controller inventory and controller capabilities.

· FSMO role placement.

· Trust relationships and decoded trust attributes.

· Application partitions and selected forest-level settings.

· Directory settings such as schema version, tombstone lifetime, and AD Recycle Bin state.

Figure 4 - Core directory documentation: forest settings, domains, domain controllers, functional levels, capability status, and naming contexts.

2. Topology and Architecture Diagrams

Documentation is much more useful when engineers can see relationships rather than only read tables. ADOutline therefore generates interactive SVG-based diagrams for major architectural elements.

· Forest and Domain Map

· Trust Map

· Replication Topology

· FSMO Placement

· Site Topology

· Certification Authority hierarchy

· DNS architecture

· Exchange architecture

· Time hierarchy

· OU hierarchy

· Other supporting relationship diagrams exposed by the collected state

Figure 5 - Replication Topology and FSMO Placement diagrams. These views provide a fast architectural summary without requiring separate diagramming software.

3. Object Population and Operational Baselines

The report records population-level information rather than attempting to retain every directory object. This keeps the report readable and helps collection scale to larger environments.

· Enabled and disabled user-account counts.

· Locked accounts and password-state indicators.

· Password-never-expires and pre-authentication-related account states.

· Administrative-account indicators such as adminCount.

· Inactive account counts across multiple age bands.

· Computer-account population and operating-system distribution.

· Group population and group-scope distribution.

Figure 6 - Object Population and Operating Systems. ADOutline presents directory populations as charts and counts rather than dumping every object into the report.

4. Identity Platforms and Hybrid Identity Signals

One of the most important improvements in the relaunched version is the recognition that AD documentation must include identity technologies connected to the directory. ADOutline can use directory objects, published service connection points, and selected software/agent evidence on domain controllers to identify identity-platform signals.

· Microsoft Entra Connect / Microsoft Entra ID synchronization-related signals

· Okta

· Ping

· SailPoint

· JumpCloud

· Duo

· Google Cloud Identity

· AD FS

This is especially valuable during consulting engagements, migrations, acquisitions, and troubleshooting because it helps answer not only 'What is in AD?' but also 'What appears to be connected to AD?'

5. Lineage, Upgrade, and Migration History

A directory contains historical evidence. ADOutline uses several forms of metadata and well-known artifacts to help document how the environment evolved over time.

· ADPREP operation clusters that can help date upgrade activity.

· Creation dates of milestone containers associated with specific Windows Server generations.

· Schema-extension timelines that can reveal when products such as Exchange, Configuration Manager, or legacy LAPS extended the schema.

· Migration artifacts such as ADMT-related groups and sIDHistory.

· Functional-level change history where replication metadata provides usable evidence.

· FRS remnants alongside DFSR and other indicators of older directory configurations.

6. Security-Relevant Configuration - Documented, Not Scored

Although ADOutline is not a security assessment, good documentation must include security-relevant configuration. The tool records these items as facts or observations rather than converting them into pass/fail findings.

· Legacy Microsoft LAPS and Windows LAPS indicators.

· Password policies and Fine-Grained Password Policies.

· Kerberos-related configuration and KRBTGT age.

· AdminSDHolder-related information.

· dMSA migration state and superseded-account linkage where available.

· Time-source and hierarchy information.

· Custom password filters and LSA packages.

· Selected backup-state evidence and domain-controller configuration details.

7. Supporting Infrastructure

· DNS architecture and zone replication behavior.

· PKI / Certification Authority hierarchy.

· Exchange-related architecture signals.

· NTP / time hierarchy.

· OU hierarchy.

· DHCP authorization.

· AD FS farm information where visible.

· Domain-controller software inventory and detected product patterns.

Figure 7 - Software detected on domain controllers, including security and backup products. ADOutline clearly labels pattern-based detection as indicative rather than proof of product configuration or active use.

How ADOutline Collects Data

A major design goal is to reduce prerequisites. ADOutline communicates with Active Directory using System.DirectoryServices.Protocols rather than relying on the ActiveDirectory PowerShell module. That means RSAT is not required, and the tool can be used from a Windows system that has network line of sight to the target domain controllers.

Collection Tiers

Tier	Method	Typical rights	What it adds
A	LDAP	Domain User	Most directory-based sections
B	SMB to SYSVOL	Domain User	GPO templates and Kerberos-policy material
C	CIM / DCOM to DCs	Local Administrator on the DC	Hardware, services, hotfixes, registry, and event-log summaries

The tiers degrade independently. If a higher-privilege collection path is unavailable, the lower-tier data can still be collected, and the report includes a permissions-by-section view so that 'not readable' is not confused with 'not configured.'

Running ADOutline

For a domain-joined machine with suitable network access, the basic execution is intentionally simple:

.\ADOutline.ps1

From a non-domain-joined Windows system, alternate credentials and a target server can be supplied:

$cred = Get-Credential
.\ADOutline.ps1 -Server dc01.contoso.com -Credential $cred

To collect directory-focused data while skipping Tier C:

.\ADOutline.ps1 -SkipTierC

To re-render an earlier collection without reconnecting to the directory:

.\ADOutline.ps1 -FromState '.\ADOutline_contoso_com_20260802_143915.state.json'

Key Parameters Worth Knowing

Parameter	Purpose
-Server	Target a specific domain controller or domain; especially useful from a non-domain-joined machine.
-Credential	Use alternate credentials.
-OutputPath	Choose where the HTML report, state file, and log are created.
-FromState	Re-render a saved state file without directory access.
-SkipTierC	Skip CIM/DCOM collection from domain controllers.
-ExcludeDC	Exclude one or more domain controllers from collection.
-NoProbe	Skip the startup capability probe.
-NoHtml	Collect state without creating the HTML report.
-NoState	Create the report without keeping a state JSON file.
-ShowDetail	Increase console detail during execution.
-SkipHotfixScan	Skip hotfix enumeration.
-SkipSoftwareScan	Skip installed-software enumeration.

What the Tool Produces

A normal collection creates three artifacts:

1. A self-contained HTML report. No CDN or external web assets are required.

2. A JSON state file containing the collected data before rendering.

3. A timestamped collection log.

The state file is strategically important. It separates collection from presentation: an existing collection can be re-rendered later without returning to the customer environment or touching the directory again. It also creates a foundation for comparing point-in-time states.

Where ADOutline Fits in the Documentation Lifecycle

ADOutline is most useful when it is treated as a documentation baseline rather than a once-only utility. Run it before a major project, retain the report and state file, and repeat the collection after significant changes.

Scenario	How ADOutline helps
Mergers & acquisitions	Document each forest before consolidation, separation, or trust redesign.
AD modernization	Capture the existing topology and dependencies before functional-level, DC, DNS, or replication changes.
Cloud / hybrid identity	Show the on-premises foundation and visible identity-platform integration signals in one report.
Audit preparation	Provide a repeatable factual record instead of relying on tribal knowledge.
MSP or team handover	Give the receiving team a readable current-state baseline.
Disaster recovery	Archive a known-good architectural reference for use during recovery planning and validation.
Consulting discovery	Reduce the time spent manually assembling domain, trust, topology, and supporting-service facts.
Change validation	Run before and after major changes to create two point-in-time records.

Why the Single-Script Model Matters

ADOutline is deliberately delivered as a single PowerShell script rather than a traditional module. For consulting, discovery, and customer environments, this can materially simplify the security-review conversation: there is one artifact to inspect, no module installation, no PSGallery dependency, and no persistent software footprint.

The packaging supports the tool's trust model: read-only collection, no agents, no installation, and no requirement to send environment data to an external service.

ADOutline, ADAtlas, and ADCanvas

These tools are complementary rather than interchangeable. A useful way to explain the family is:

Tool	Primary purpose	Question answered
ADOutline	Documentation	What is configured right now?
ADAtlas	Visualization	What does the environment look like?
ADCanvas	Analysis	What does the environment mean from a health/security perspective?
ADLens	Change tracking	How has the environment changed over time?

A Practical Documentation Workflow

1. Run ADOutline from a suitable Windows system with network access to the directory.

2. Review the Collection Rights / permissions section first to understand which data sources were available.

3. Review the forest, domain, DC, trust, and topology sections to establish the architectural baseline.

4. Review the identity-platform section to understand visible hybrid identity dependencies.

5. Review object populations, supporting services, and domain-controller configuration.

6. Save the HTML, state JSON, and log together as a dated evidence package.

7. Repeat the collection after material architecture changes and retain both snapshots.

Why I Built ADOutline as a Documentation Tool

I do not position ADOutline as another AD scanner or a security scorecard. It is an automated current-state documentation engine for Active Directory and its surrounding identity infrastructure. The value is straightforward: turn live directory configuration into a consistent, portable, point-in-time document with diagrams, tables, population summaries, and hybrid-identity context.

ADOutline turns Active Directory configuration into documentation: one PowerShell script, one collection, one self-contained report.

Important Usage Notes

· Treat identity-platform and installed-software detection as evidence-based indicators. Pattern detection does not prove that a product is licensed, configured, or actively used.

· A missing section can reflect missing permissions or connectivity rather than an absent feature; review the report's collection-rights information.

· ADOutline is documentation, so it should not be presented as a substitute for a security assessment or formal architecture review.

· Protect generated reports and state files appropriately because they may contain sensitive infrastructure metadata.

Conclusion

Good Active Directory documentation should not depend on a person remembering how the forest evolved. It should be repeatable, current, readable, and easy to archive. ADOutline is designed around that goal.

The relaunched version extends the original documentation concept into the hybrid identity era: it still records the foundational AD configuration, but it also brings Microsoft Entra Connect and other connected identity-platform signals into the same documentation story. That makes the output useful not only for AD administrators, but also for identity architects, security teams, auditors, consultants, migration teams, and anyone who needs to understand the current shape of an Active Directory environment.

#ActiveDirectory #ADDocumentation #PowerShell #IdentitySecurity #HybridIdentity #MicrosoftEntra #EntraID #MicrosoftEntraConnect #IAM #IdentityManagement #CyberSecurity #WindowsServer #MicrosoftSecurity #Okta #ADSecurity #ZeroTrust #ITDocumentation #ActiveDirectorySecurity #DirectoryServices

PoweShell TTUC (Tips, Tricks and Useful Commands) #114 – Move Files and Folders

noreply@blogger.com (Blog-5) — Fri, 30 Mar 2018 07:00:00 +0000

PowerShell TTUC (Tips, Tricks and Useful Commands) - #114

Create a folder and assign appreciate permission using PowerShell

$OutputLocation = "C:\Temp\Folder1"
$adminUser = "Domain\Admin1"

#
if (-not(test-path $OutputLocaiton)) #verify the existance of "C:\Temp\Folder1" fodler
{
#if not create a new folder
New-Item -ItemType directory -Path $OutputLocaiton | out-null
$cACL = Get-Acl $OutputLocaiton
$nACL = New-Object system.security.accesscontrol.filesystemaccessrule($adminUser,"Fullcontrol","Allow")
$cACL.SetAccessRule($nACL)
Set-Acl $OutputLocaiton $cACL

}

Update Group Membership – PowerShell Script

noreply@blogger.com (Blog-5) — Mon, 26 Mar 2018 07:00:00 +0000

If you have multiple domains or performing a user or group migration, you may need to manually update (depend on your scenario) the source or target group membership. This script can be used to update group membership based on source user’s group membership. The input for this script the user name (sAMAccountName) and it assumes that the source and target sAMAccountName are the same.

Input file (Users.csv) Format:

Script validates users in the source domain and collect “memberof” details and then add the target user (migrated user) to the same group. At the end of the operation, the source user and the target user (migrated user) will be part of same security group in the source domain.

You can see some other “Update Group Membership” script here - http://portal.sivarajan.com/2014/01/update-group-membershippowershell-script.html

Script:

# Update Group Membership

# Santhosh Sivarajan (Santhosh@Sivarajan.Com)

Clear

Import-Module ActiveDirectory

$userN = ""

$GroupDetails = ""

$Group = ""

$GroupsDN = ""

$uValidation = ""

$tagetDomain = "labanddemo.com"

$Cdate = (Get-Date).tostring("dd-MM-yyyy-hh-mm-ss")

$SGBeforeUpdateFile = New-Item -type file -force "C:\Temp\Groups_Before_$Cdate.csv"

$SGAfterUpdateFile = New-Item -type file -force "C:\Temp\Groups_After_$Cdate.csv"

Import-CSV "C:\Temp\Users.csv" | % {

$userN = $_.userName

$sourceDomain = $_.Domain

$uValidation = Get-ADUser -filter {sAMAccountName -eq $userN} -Server $tagetDomain

If($uValidation -eq $Null)

{

Write-Host "User $userN Doesn't Exist in $tagetDomain Domain"

$errorFile = New-Item -type file -force "C:\Temp\Error_$Cdate.csv"

"User $userN Doesn't Exist in $tagetDomain Domain"| Out-File $errorFile -encoding ASCII -append

}

Else

{

$userN | Out-File $SGBeforeUpdateFile -encoding ASCII -append

$GroupDetails = get-aduser -Server $sourceDomain -identity $userN -Properties memberof

$GroupsDN = $GroupDetails.memberof

$GroupsDN | Out-File $SGBeforeUpdateFile -encoding ASCII -append

foreach ($Group in $GroupsDN)

{

$MigrateduserN = Get-ADUser $userN -Server $tagetDomain -Properties DistinguishedName

Write-host "Adding User -> $MigrateduserN"

Write-host "To Group -> $Group"

Add-ADGroupmember -Server $sourceDomain -Identity $Group -Members $MigrateduserN

$members = Get-ADGroupmember -Server $sourceDomain -Identity $Group

$GroupName = Get-ADGroup -Server $sourceDomain $Group

$GroupName.Name | Out-File $SGAfterUpdateFile -encoding ASCII -append

$members.distinguishedName | Out-File $SGAfterUpdateFile -encoding ASCII -append

Write-host "....Done!" -ForegroundColor Green

Write-host ""

}

Download:

You can also download the script from the following locations:

OneDrive
TechNet Gallery

Group Membership Report – PowerShell Script

noreply@blogger.com (Blog-5) — Fri, 23 Mar 2018 07:00:00 +0000

Another “Group Membership Report” script. You can see some of the previous versions here - http://portal.sivarajan.com/2010/08/list-group-members-in-active.html.

This script provides the group membership details based on user name. You can include all user names in an input file (Users.csv) in the following format:

Script uses Get-ADUser cmdlet to validate the user first then get the user membership using the “memberof” properties. Output/report will be in the GMReport_$Cdate.csv file. Error message will be captured in Error_$Cdate.csv file.

Script:

#Group Membership Report – PowerShell Script

#Santhosh Sivarajan (santhosh@sivarajan.com)

Clear

Import-Module ActiveDirectory

$userN = ""

$GroupDetails = ""

$Group = ""

$GroupsDN = ""

$uValidation = ""

$Cdate = (Get-Date).tostring("dd-MM-yyyy-hh-mm-ss")

$Report = New-Item -type file -force "C:\Temp\GMReport_$Cdate.csv"

Import-CSV "C:\Temp\Users.csv" | % {

$userN = $_.userName

$sourceDomain = $_.Domain

$uValidation = Get-ADUser -filter {sAMAccountName -eq $userN} -Server $sourceDomain

If($uValidation -eq $Null)

{

Write-Host "User $userN Doesn't Exist in $sourceDomain Domain"

$errorFile = New-Item -type file -force "C:\Temp\Error_$Cdate.csv"

"User $userN Doesn't Exist in $sourceDomain Domain"| Out-File $errorFile -encoding ASCII -append

}

Else

{

$userN | Out-File $SGBeforeUpdateFile -encoding ASCII -append

$GroupDetails = get-aduser -Server $sourceDomain -identity $userN -Properties memberof

$GroupsDN = $GroupDetails.memberof

$GroupsDN | Out-File $SGBeforeUpdateFile -encoding ASCII -append

}

Download:

You can also download the script from the following locations:

OneDrive
TechNet Gallery

Advanced Threat Analytics–Attack Simulation and Demo – Part1

noreply@blogger.com (Blog-5) — Fri, 22 Dec 2017 08:00:00 +0000

Advanced Threat Analytics–Attack Simulation and Demo–Part1

Advanced Threat Analytics–Attack Simulation and Demo–Part2

Advanced Threat Analytics–Attack Simulation and Demo–Part3

Suspicious Activity Simulation #1 – ATA Gateway Stopped Communicating

We will start with the most obvious one! – ATA communication issue. In this scenario, I am using ATA Light Weight Gateway(LWGW). In this case Microsoft Advanced Threat Analytics Gateway (ATAGateway) service should be running on Domain Controllers.

To simulate this scenario,

Identify all Domain Controllers from the forest/domain. You can use the following DSQUERY command to get all DCs from the domain.
- DsQuery Server -Forest
Stop the ATAGateway service remotely
- Here are a few scripts - Script1 or Script2 or Script3 – if you want to go a script based approach
- Or we can use a simple SC command – SC \\Lab-DC01 stop ATAGateway

You will receive the following high alert – ATA Gateway Stopped Communicating – in Health Center.

Suspicious Activity Simulation #2- Honey Token Account Activities

In general, the Honey Token accounts are non-interactive accounts. These accounts can be dummy accounts for detect malicious activities.

To simulate this scenario,

Create two 2 user accounts in Active Directory (ATA-Test1 and ATA-Test2)
Add ATA-Test2 to Domain Admins group
Get the SID of ATA-Test1 and ATA-Test2 using PowerShell or DSQUERY command
- dsquery * -filter (samaccountname=ata-test1) -attr objectsid (Reference)
- Get-ADUser Ata-test1 -Properties objectSID (Reference)
Add this SID as Honey token accounts (ATA Console –> Configuration –> Detection –> Honeytoken Account SIDs). Save the configuration.
Establish an integrative logon session using these accounts. You can RDP into a machine use these accounts

Honey Token accounts (non-sensitive)

You will receive the following alert/email with recommended actions in the ATA console.

Honey Token accounts (Sensitive)

Since ATA-Test2 account is a domain admin account, you will receive the same alert with "Sensitive (S )" indicating that this account is a high privileged account in Active Directory.

Suspicious Activity Simulation #3 – Massive Object Deletion

Bulk object deletion can be a suspicious activity in an Active Directory environment. ATA can alert alert you based on massive object deletion activities.

To simulate this scenario,

Create a few users in Active directory. Here is a sample PowerShell script which you can use to create test accounts in Active Directory

Clear
Import-module activedirectory
$pass = ConvertTo-SecureString "MyPassword0!" –asplaintext –force
for ($i=0;$i -lt 100;$i++)
{
$accountname = "Test-Account$i"
Write-Host "Creating $accountname" -NoNewline
New-ADUser –SamAccountName $accountname –name $accountname -OtherAttributes @{'description'="ATA Test User Account"} -Path "OU=Test Accounts,OU=User Accounts,DC=labanddemo,DC=com"
Set-ADAccountPassword –identity $accountname –NewPassword $pass
Write-Host "...Done"
}

Make sure ATA is "learned" about these account.
Delete these accounts from Active Directory

You will receive the Massive Object Deletion alert in the ATA console right away as shown below.

Suspicious Activity Simulation #4 - Reconnaissance using DNS

The DNS or name resolution information in a network would be useful reconnaissance information. In general, DNS data contains a list of all the servers and workstations and the mapping to their IP addresses. Verifying this information may provide attackers with a detailed view of the environment allowing attackers to focus their efforts on the relevant entities.

For this simulation, the plan is to perform a DNS zone lookup using NSLOOKUP LS command.

To simulate this scenario,

Logon to a remote server.
Open Command Prompt and run NSLOOKUP command
From the NSLOOKUP window, run LS command to list the DNS zone

You will receive the following Reconnaissance using DNS alert the ATA console.

Advanced Threat Analytics–Attack Simulation and Demo–Part1

Advanced Threat Analytics–Attack Simulation and Demo–Part2

Advanced Threat Analytics–Attack Simulation and Demo–Part3

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server

noreply@blogger.com (Blog-5) — Sat, 11 Nov 2017 08:00:00 +0000

Related Blogs:

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/06/configuring-yubikey-yubico-oath-token.html
Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Microsoft Azure MFA on-premises server supports a time based OATH (OATH – TOTP) third party tokens. This is an alternative to using the Azure Authenticator Mobile App as an OATH token. You can see other MFA authentication options in my Azure MFA Server–Authentication Types (Part I) and Azure MFA Server–Authentication Types (Part II) blogs. The OATH tokens can be added or imported prior to being associated with a user. Administrators can associate users and tokens in the Multi-Factor Authentication Server or the User Portal. Users can associate themselves with an OATH token during User Portal enrollment or using the OATH Token menu option when the User Portal is configured to provide this functionality. A bulk token import and configuration is also supported by MFA Server . An administrator can import OATH Token records from an input file . The secret keys must be in Base32 format.

This blog provides step-by-step instructions in configuring Deepnet SafeID OATH token with Microsoft Azure MFA server. I am using DeepNet Security's SafeID Classic model for this testing. You can review different token models and details on their website.

Requirements:

The following are the pre-requirements to complete this configuration.

Microsoft Azure MFA on-premises server
Deepnet SafeID hardware
Secret Key for your DeepNet SafeID. You will receive an email with Secret Key after the purchase.

Review the following Azure MFA Server Authentication Types blog if you are not familiar with authentication configuration in Azure MFA Server:

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Azure MFA Server – Configuration for third Party OATH

First step in this process is to add third party OATH Tokens in Azure MFA Server. You can either add these tokens individually or perform a bulk import using an input file.

To add an OATH token,

Logon to your MFA application server. Open Multi-Factor Authentication Server UI and Select OATH Token icon.
Click Add option from OATH Token window.
Enter your Secret Key token Details
1. Serial Number – Required. Enter the serial number of your SafeID. This will be in the back of the Secret Keyas shown below or it will be the email you received from DeepNet.
3. Secret Key – Required. This is the Secret Key (Base32). You have to receive this information from DeepNet. You will receive an email from Deepnet with Secret Key after the purchase
4. Manufacturer – Optional. Enter DeepNet Security as the manufacturer.
5. Model – Optional. Enter SafeID as model type.
6. Start date – Optional
7. Expiration date – Optional
8. Time interval – Required. Select 60 seconds.
9. Username: Associate a user with this OATH token. You can manually enter the username or Select Useroption to identify a user.
11. Click OK to complete. The Synchronize OATH Token dialog will prompt for the current OATH code to synchronize the OATH token and verify the configuration.
13. Enter the current code from DeepNet SafeID from the Synchronize OATH Token window to complete token configuration in MFA Server. Click OK.

Note1: MFA server validates the OATH code against the OATH token secret key and synchronizes the OATH token's time if they are valid. If there are not valid, you will see the following error message:

Note2: Azure Multi-Factor Authentication Server supports bulk import of token records by using an input CSV file. The file must be in a supported format and may be partially or fully encrypted with a password.

Sample Input File

To perform a bulk import,

Note3: you may receive the following error message when you click on Import button. There is an update/hotfix for this issue.

Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.

Could not load file or assembly ‘PfPskcClr, Version=0.0.0.0, Culture=neutral, PublicKey Token=null’ or one of its dependencies. A strongly-named assembly is required. (Exception from HRRESULT:0X8013100)

Azure MFA Server – End User Validation Using DeepNet SafeID OATH Token

The final step in this process is to validate the DeepNet SafeID configuration and authentication experience from an end user perspective.

To configure OATH token as the authentication type for an end user:

From Multi-Factor Authentication Server UI, Select Users icon
From right pane, open the user properties by double clicking the user object.
This will open User Properties / Edit User window as shown below. Make sure that the OATH Token is selected as the authentication type for this test user.
To validate this configuration, select out test user object and from the bottom of the window, select Test option.
User will be prompted for first /primary authentication using a user name and password. Enter the User name and Password for the user, then click Test.
Then it will prompt you for the secondary authentication. In this scenario, it the OATH Code.
Get the current OATH code from your DeepNet SafeID.
Enter the current code in the OATH Code window in the MFA application . Click OK.
You will see the authentication status/result as shown below:

Related Blogs:

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/06/configuring-yubikey-yubico-oath-token.html
Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server

noreply@blogger.com (Blog-5) — Fri, 13 Oct 2017 07:00:00 +0000

Related blogs:

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/07/configuring-deepnet-security-safeid.html
Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Requirements:

The following are the pre-requirements to complete this configuration.

YubiKey Personalization Tool – Installation and Configuration

Microsoft Azure MFA server supports only the OATH TOTP (time-based) tokens. So you need to make sure that your YubiKey is in Yubico OTP Mode using the YubiKey Personalization Tool. Other configurations are optional for Microsoft Azure MFA server configuration and testing.

The YubiKey Personalization Tool can be used to program the two configuration slots. Also, it can be used to personalize the YubiKey in the following modes:

Yubico OTP
OATH-HOTP
Static Password
Challenge-Response

Download YubiKey Personalization Tool and run yubikey-personalization-gui-3.1.24.exe file to compete the tool installation.

Insert YubiKey into the USB port. You may see the Device Setup windows as shown below. Complete the drive installation process.
Open YubiKey Personalization Tool. Make sure:
1. YubiKey Personalization Tool has successfully identified your YubiKey.
3. Yubico OTP displayed as supported method in Features Supported section.
You will see all the current OTP configuration in Yubico OTP tab shown below. I am going to a use the default configuration for this testing.

YubiCo Authenticator Application – Installation and Configuration

Download YubiCo Authenticator Application and run yubioath-desktop-3.0.1-win.exe file to complete the application installation.

Open YubiCo Authenticator Application
From File menu, select Add option (File –> Add)
From the New Credential window:
1. Enter Credential Name – An identifier or a display name for the credential.
2. Secret Key – It is a Base32 key. Review this If you are not familiar with supported numbers or characters in Base32 encoding.
3. Select Time based (TOTP) option. Microsoft Azure MFA server supports only the OATH TOTP (time-based)tokens.
4. Number of digits – You can select 6 or 8 digits as OATH token length.
6. Require touch - If you select this option, end user has to touch the YubiKey to generate an OATH token. User will prompted with the following message:
8. Click OK to save the configuration
10. You will see the newly add account in the Yubico Authenticator window.

Now we have completed the YubiKey account configuration. We can move on to Azure MFA server to configure the OATH token.

Azure MFA Server - Configuration for third Party OATH

Review the following Azure MFA Server Authentication Types blog if you are not familiar with authentication configuration in Azure MFA Server:

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

To add OATH Token in Azure MFA Server,

Open Multi-Factor Authentication Server UI and Select OATH Token icon.
Click Add option from OATH Token window.
Enter your YubiKey token Details
1. Serial Number – Required. Enter the YubiKey serial number. This will be in the back of the Yubikey as shown below:
3. Secret Key – Required. This is the Secret Key (Base32) you have configured using the Authentication Application.
4. Manufacturer – Optional. Enter Youbico as the manufacturer.
5. Model – Optional. Enter your YubiKey model type.
6. Start date – Optional
7. Expiration date – Optional
8. Time interval – Required. You can select the default 30 seconds value. By default, YubiKey changes the 6-8 digit code every 30 seconds.
9. Username: Select the user for this OATH token. You manually enter the username or Select User option to identify a user.
10. Click OK to complete. The Synchronize OATH Token dialog will prompt for the current OATH code to synchronize the OATH token and verify the configuration.
12. Generate a new OATH from Yubico Authentication app using the button.
14. Enter this code in the Synchronize OATH Token window to complete token configuration in MFA Server.

Sample Input File

To perform a bulk import,

Select OATH Token icon and select Import.
Select the input file and click Import.

Note3: you may receive the following error message when you click on Import button. There is an update/hotfix for this issue.

Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.

Azure MFA Server – End User Validation Using YubiKey OATH Token

The final step in this process is to validate the YubiKey configuration and authentication experience from an end user perspective.

To configure OATH token as the authentication type for an end user:

From Multi-Factor Authentication Server UI, Select Users icon
From right pane, open the user properties by double clicking the user object.
This will open User Properties / Edit User window as shown below. Make sure that the OATH Token is selected as the authentication type for this test user.
To validate this configuration, select out test user object and from the bottom of the window, select Test option.
User will be prompted for first /primary authentication using a user name and password. Enter the User name and Password for the user, then click Test.
Then it will prompt you for the secondary authentication. In this scenario, it the OATH Code.
To generate a new OATH code, open Yubico Authenticator App and pressing the button . The OATH code will be displayed as shown below:
Enter the current OATH code in the OATH Code in the MFA application window. Click OK.
You will see the authentication status/result as shown below:

Related blogs:

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/07/configuring-deepnet-security-safeid.html
Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html
Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Enable Phone Sign-In–Microsoft Authenticator

noreply@blogger.com (Blog-5) — Tue, 18 Apr 2017 23:26:00 +0000

Alex Simons has recently blogged on "No password, phone sign in for Microsoft accounts". This a great enhancement in Microsoft second factor or "no password" technology.

There are a few things you need to consider to complete "phone sign" option.

If you have Microsoft Authenticator configured for your personal account, you will see an option from the dropdown menu to select Enable phone sign-in.

But you don't see this option If you are adding a new Microsoft account on an iPhone. Microsoft will automatically set it up for you by default. So add your Microsoft Account and login to a Microsoft service using this account. You will see an additional "password less" (use the Microsoft Authenticator app instead) sign in option as shown below:

If you don't configure or add your Microsoft account in your Authenticator App, you don't see a "use the Microsoft Authenticator app instead" option. Instead, you will have only see the password sign-in option as shown below:

You will see the following verification message on your login screen and on your mobile device.

If you are adding a new account on an Android device , It will be enabled by default and prompt you to complete it.

Duplicate Attribute Resiliency - New Identity Synchronization Feature

noreply@blogger.com (Blog-5) — Fri, 31 Mar 2017 14:51:00 +0000

I just received an email with a subject of "New Identity Synchronization Feature Being Enabled - Duplicate Attribute Resiliency". Microsoft has provided detailed information in this email. I thought that was interesting and of course very useful! Great job Microsoft and looking forward to receiving these types of additional information about upcoming features.

Here are the details of Duplicate Attribute Resiliency:

A new feature called Duplicate Attribute Resiliency is being introduced in order to eliminate friction caused by duplicate UserPrincipalName and ProxyAddress conflicts when running one of Microsoft’s synchronization tools. This new feature is being rolled out across all of Azure Active Directory, and will be enabled for your tenant on 04/19/2017. The new behavior that this feature enables is in the cloud portion of the sync pipeline, therefore it is client agnostic and relevant for any Microsoft synchronization product including Azure AD Connect, DirSync and MIM + Connector. Please read on to learn how this change impacts the way Azure Active Directory handles these specific certain types of Identity synchronization errors.

Current behavior

If there is an attempt to provision a new object with a UPN or ProxyAddress value that violates this uniqueness constraint, Azure Active Directory blocks that object from being created. Similarly, if an object is updated with a non-unique UPN or ProxyAddress, the update fails. The provisioning attempt or update is retried by the sync client upon each export cycle, and continues to fail until the conflict is resolved. An error report email is generated upon each attempt and an error is logged by the sync client.

New Behavior - with Duplicate Attribute Resiliency

Instead of completely failing to provision or update an object with a duplicate attribute, Azure Active Directory “quarantines” the duplicate attribute which would violate the uniqueness constraint.
If this attribute is required for provisioning, like UserPrincipalName, the service assigns a placeholder value. The format of these temporary values is “+<4digitnumber>@.onmicrosoft.com”.
If the attribute is not required, like a ProxyAddress, Azure Active Directory simply quarantines the conflict attribute and proceeds with the object creation or update.
Upon quarantining the attribute, information about the conflict is sent in the same error report email used in the old behavior. However, this info only appears in the error report one time, when the quarantine happens, it does not continue to be logged in future emails. Also, since the export for this object has succeeded, the sync client does not log an error and does not retry the create / update operation upon subsequent sync cycles.

The way all other types of errors are processed remains unchanged, this feature is only relevant for duplicate UserPrincipalName and ProxyAddress conflicts.

To read more about the behavior change along with identifying and resolving conflicts, please see this article: Identity synchronization and duplicate attribute resiliency

Azure MFA Server –Authentication Types (Part II)

noreply@blogger.com (Blog-5) — Thu, 16 Feb 2017 15:40:00 +0000

Azure MFA–Authentication Type (Part I)

Azure MFA–Authentication Type (Part II)

Original post - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

The Microsoft Azure Multi-Factor Authentication (MFA) provides various authentication types when using an on-premises MFA server. The Company Settings section allows the Multi-Factor Authentication (MFA) administrator to define company wide settings for all users.

The administrators can also make (or override) individual user configuration from User Section.

An end user can make their own sections from the the User Portal.

In general, the following authentication modes are available when using an on-premises MFA server. The purpose of this blog is to explain each of these authentication types and expected result with screenshots.

Phone call (Standard)
Phone call (PIN)
Text message (One-way OTP)
Text message (Two-way OTP)
Text message (One-way OTP + PIN)
Text message (Two-way OTP + PIN)
Azure Authenticator application (Standard)
Azure Authenticator application (PIN)
Azure Authenticator application (OATH token)
Third Party OATH token

In this blog, I will be covering the following authentication types.

Azure Authenticator application (Standard)
Azure Authenticator application (PIN)
Azure Authenticator application (OATH token)
Third Party OATH token

Review Part I of this blog for other authentication type details.

The Azure Mobile App mode results in a notification being sent to the user's Azure Authenticator mobile app. There are 2 different modes for Mobile App – Standard and PIN mode.

Azure Authenticator application -Standard

In this mode, user will be prompted for primary authentication using a user name and password and the second authentication is when the user receives a notification in the Azure Authenticator mobile app.

Expected Result

In Standard Mode, users will prompted to authenticate, deny, or deny and report fraud as shown below:

Azure Authenticator application – PIN

The PIN mode enhances the security of the Multi-Factor Authentication by requiring the user enter a PIN in the Azure Authenticator mobile app.

Expected Result

Azure Authenticator application - OATH token

Oath Token mode results in the user being prompted for an OATH code to authenticate with Multi-Factor Authentication. Time-based OATH codes can be generated by the Azure Authenticator Mobile App or a third-party token. We will start with Azure Authenticator Mobile App. As shown in the following screenshot, the OATH Tokens (Enable OATH Tokens) must be enabled in the MFA Server console to display a Time-based OATH codes in Azure Authenticator Mobile App. keep in mind that the OATH Token method is only supported by RADIUS Authentication and IIS Authentication Form-Based Authentication.

After the activation of Mobile App, users can select OATH token mode from the User Portal or an administrator can configure this from a MFA server console.

Expected Result

A Time-based OATH codes will be generated by Azure Authenticator Mobile App as shown below.

This code needs to entered in the respective application to complete the second factor authentication.

Third Party OATH token

Azure MFA server supports a time based OATH (OATH – TOTP) third party tokens. This is an alternative to using the Azure Authenticator mobile app as an OATH token (see the above scenario - Azure Authenticator application -Standard). OATH tokens can be added or imported prior to being associated with a user. Administrators can associate users and tokens in the Multi-Factor Authentication Server (as shown below) or the User Portal. Users can associate themselves with an OATH token during User Portal enrollment or using the OATH Token menu option when the User Portal is configured to provide this functionality. A bulk token import and configuration is also supported by MFA Server . An administrator can import OATH Token records from an input file . The secret keys must be in Base32 format.

For this scenario, I am using Yubikey 4 (Yukico) OATH token as the third party OATH token. You need to use Yubico Authentication application to get the OATH code from Yukikey. Review my Azure MFA and Yubico OATH configuration blog for the configuration details.

The OATH token option is same as the Azure Authenticator mobile app configuration as shown below:

Expected Result

In this scenario, you will be using the Time-based OATH codes generated by Yubico Authenticator application.

This OATH code must be entered in the respective application to complete the second factor authentication.

If you have Azure Mobile App OATH and a third party OATH token active for the same user, both token code will be valid.

Azure MFA–Authentication Type (Part I)

Azure MFA–Authentication Type (Part II)

Azure MFA Server–Authentication Types (Part I)

noreply@blogger.com (Blog-5) — Thu, 16 Feb 2017 15:39:00 +0000

Azure MFA Server–Authentication Type (Part I)

Azure MFA Server–Authentication Type (Part II)

Original post - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

The administrators can also make (or override) individual user configuration from User Section.

An end user can make their own sections from the the User Portal.

Phone call (Standard)
Phone call (PIN)
Text message (One-way OTP)
Text message (Two-way OTP)
Text message (One-way OTP + PIN)
Text message (Two-way OTP + PIN)
Azure Authenticator application (Standard)
Azure Authenticator application (PIN)
Azure Authenticator application (OATH token)
Third Party OATH token

We will start with standard Phone Call option. The Phone call authentication type has two sub options:

Phone call (Standard)
Phone call (PIN)

Authentication Type : Phone Call – Standard

Expected Result

In this mode, user will be prompted for first authentication using a user name and password and then the second authentication is based on the phone call as shown below:

The first authentication is based on the configuration in MFA. For example, for RADIUS, you an select the following options from the Target tab:

The “from” telephone number can be customized from azure console (https://manage.windowsazure.com/ –> Active Directory –> Configure –>Multi-factor Authentication –> Manage Service Settings –> Go to the Portal –> Configure –> Settings –> General Settings –> Caller ID Phone Number) as shown below:

Also, the Voice Messages can be customized based on your requirements. This option is available in https://manage.windowsazure.com/ –> Active Directory –> Configure –>Multi-factor Authentication –> Manage Service Settings –> Go to the Portal –> Configure –> Voice Message section.

Authentication Type : Phone Call – PIN

In this scenario, we will use Phone call with PIN option.

Expected Result

In this mode, user will be prompted for first authentication using a user name and password and then the second authentication is based on the phone. During the phone call, MFA will ask you to enter a personalized PIN.

The PIN creation and enforcement is based on the following configuration in user section.

You also have an option in Company Settings section to enforce default PIN rules as shown below:

The next authentication type is Text message. Text Message type has four sub options:

Text message (One-way OTP)
Text message (Two-way OTP)
Text message (One-way OTP + PIN)
Text message (Two-way OTP + PIN)

Authentication Type : Text message - One-way OTP

Expected Result

The user must enter this One-Time Passcode (OTP) in the respective application to complete the authentication request. You application must support Challenge – Response (Authentication Chaining).

Authentication Type : Text message – Two-way OTP

Expected Result

In this mode, user will be prompted for first authentication using a user name and password and then the second authentication is based on a text message containing a One-Time Passcode (OTP). The user must reply to the same text message by entering the provided OTP to complete the authentication request as shown below:

Authentication Type : Text message - One-way OTP + PIN

Expected Result

This One-Time Passcode (OTP) + PIN needs to be entered in the application to complete the authentication request.

The PIN values is based on the configuration in the user or Company Settings:

User settings:

Company Settings:

Authentication Type : Text message – Two-way OTP + PIN

Expected Result

In this mode, user will be prompted for first authentication using a user name and password and then the second authentication is based on a text message containing a One-Time Passcode (OTP) + PIN. The user must reply to the same text message by entering the provided OTP + their personal PIN to complete the authentication request as shown below:

I believe we have enough information and screenshots for this blog . I will cover the following authentication types in the Part-II of this blog:

Azure Authenticator application (Standard)
Azure Authenticator application (PIN)
Azure Authenticator application (OATH token)
Third Party OATH token

Azure MFA Server–Authentication Type (Part I)

Azure MFA Server–Authentication Type (Part II)

Happy New Year – Microsoft Most Valuable Professional (MVP) Award 2017

noreply@blogger.com (Blog-5) — Sun, 01 Jan 2017 16:04:00 +0000

Happy New Year – Microsoft Most Valuable Professional (MVP) Award

Received the Microsoft Most Valuable Professional (MVP) award this year also. Great start to 2017!

PowerShell - Send Test Email (Office 365) Using PowerShell

noreply@blogger.com (Blog-5) — Thu, 08 Dec 2016 15:22:00 +0000

Here is a sample PowerShell script which can be to test email communication using a SMTP server. In this script, I am using Office 365 SMTP server, smtp.office365.com.

Script:

$SMTPServer = "smtp.office365.com"

$EmailFrom = "Santhosh@virtualsecuritysolutions.com"

$EmailTo = "santhosh@ss-ts.com"

#Send-MailMessage Reference - https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/send-mailmessage

Write-Host "`t`tSelect 1 - SMTP Test Message with No Attachmnet" -ForegroundColor Red

Write-Host "`t`tSelect 2 - SMTP Test Message" -ForegroundColor Red

$Option = Read-Host

Function EmailTest_No_Attachment

{

#with no attachement

$Cred = Get-Credential

$Sub = "SMTP Test Message - 1 - No Attachmnet"

$Bmessage = "SMTP Test Message - 1 with Attachment"

Send-MailMessage -From $EmailFrom -To $EmailTo -Subject $Sub -Body $Bmessage -SmtpServer $SMTPServer -Credential $cred -UseSsl -Port 587

}

Function EmailTest_With_Attachment

{

#with Attachment

$Cred = Get-Credential

$Sub = "SMTP Test Message - 1 with Attachment"

$Bmessage = "Test email body message - With Attachment"

$MyAttachment = "C:\temp\1.docx"

Send-MailMessage -From $EmailFrom -To $EmailTo -Subject $Sub -Body $Bmessage -Attachments $MyAttachment -SmtpServer $SMTPServer -Credential $cred -UseSsl -Port 587

}

Switch ($Option)

{

1 {EmailTest_No_Attachment}

2 {EmailTest_With_Attachment}

default {"Invalid Selection"}

}

Script download options:

1. OneDrive - https://1drv.ms/t/s!AuVEEHIwTxv9h4ZXLslcu1MzA8ZSqw

2. TechNet Gallery - https://1drv.ms/t/s!AuVEEHIwTxv9h4ZXLslcu1MzA8ZSqw

Windows Server 2016–Active Directory–Part1

noreply@blogger.com (Blog-5) — Thu, 20 Oct 2016 07:00:00 +0000

Part1 - Windows Server 2016 – Active Directory
Part 2 - Windows Server 2016 – Active Directory – Temporary Group Memberships

As you know, the latest version of Windows Server - Windows Sever 2016 - is currently available. It is available in Azure as well as I mentioned here. You can read “what is new with Windows Server 2016” in this Microsoft article here. In general, Windows Server 2016 provides:

Added layers of security - Enhance security and reduce risk with multiple layers of built-in protection.
New deployment options - Increase availability and reduce resource usage with the lightweight Nano Server.
Built-in containers - Develop and manage with agility thanks to Windows Server and Hyper-V containers.
Cost-efficient storage - Build highly available, scalable software-defined storage and reduce costs.
Innovative networking - Software-defined networking to automate with cloud-like efficiency.

I am not going to the details of Windows Server 2016 or it’s capabilities here. You can read all that information in the above mentioned URL. My plan is to start a new blog series on Windows Server 2016 and Active Directory functionalities. To begin this, I will add a new Widows Sever 2016 to my existing Active Directory 2012 domain and promote the Widows Sever 2016 as an additional domain controller. The Domain Promotion process is very similar to the previous versions of windows.
There is an upgrade to Active Directory Schema. Shema can be upgraded during the domain promotion process. The new Schema or ObjectVersionNumber is 87. Some addition information is included here in my TechNet wiki article. You can verify this by using ADSI Edit or DSQuery or PowerShell commands.
Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion

dsquery * CN=Schema,CN=Configuration,DC=labanddemo,DC=com -scope base -attr objectVersion

As a reference, I have provided the following table that lists the Active Directory Schema and the corresponding Object Version:

Active Directory	Object Version
Windows 2000	13
Windows 2003	30
Windows 2003 R2	31
Windows 2008	44
Windows 2008 R2	47
Windows 8 Beta	52
Windows 2012	56
Windows 2012 R2	69
Windows Server 2016	87

***ObjectVersion 39 - Please refer http://blogs.technet.com/b/askds/archive/2011/07/15/friday-mail-sack-peevish-nediquette-edition.aspx
Anyway, we can start this journey with DC promotion process. The following section provides step-by-step instructions.

Join computer to your exiting Active Directory Domain.

2. Click OK on the Welcome window and restart the server. After the reboot, this server will be member server in your existing Active Directory Domain. By default, this server will be in Computer Container.

3. Login to the server using a domain credentials (domain\username). You need to have proper permission to upgrade the schema and add an additional domain controller.

4. Next step is to add ADDS server roles onto your new Windows Server 2016 server. Open Server Manger and select Add Roles and Features option.

5. Click Next on the Before you begin window.

6. Select Role-based or Feature-based installation option. Click Next.

7. On the Select Destination Server window, select your local Windows Server 2016 server. Click Next.

8. From Server Roles option, select Active Directory Domain Services. Accept the additional Role Feature requirements. Click Add Features.

9. Click Next on the Select Features window.

10. Click Next on Active Directory Domain Services window.

11. Select Install option to begin AD DS role installation Process.

12. Now you have installed the AD DS role onto your new Windows Server 2016. Next step is to add an additional domain controller for your existing domain. As you can see on the following screenshot, you need to perform some cognition and post-deployment option to complete this task. Click Close.

From Server Manager, select Promote this server to a domain controller option. This will initiate the DCPROMO (Yes. I still like this word!) process.

14. As you can see on the following screenshot, you have 3 options:
1. Add a domain controller for an existing domain
2. Add a new domain to an existing forest
3. Add a new forest.
4. For this exercise, you will be selecting the first option - Add a domain controller for an existing domain
5. If you have only one domain and this new server is part of that domain, default domain name will be listed in the Domain column.
6. Provide a domain credential with proper permission to perform these tasks. If the current/logged in user doesn’t have sufficient permission, you can select Change option to enter a new credential.

15. From the Domain Controller Options window,
1. select the appropriate options for your environment. In my scenario, I will be selecting:
1. Domain Name System (DNS) server
2. Global Catalog (GC)
2. Provide a password for Directory Service Restore Mode (DSRM)
3. Click Next.

16. Click Next on the DNS Options window.

17. On the Additional Options window, select appropriate AD data replication option. I will be selecting Any Domain Controller option for this exercise. Click Next.

18. From Paths window, select appropriate path for AD Database and Log file. Click Next.

19. The next section will perform:
1. Forest and Schema peroration for Windows Server 2016.
2. Domain Preparation for Windows Server 2016.
3. Click Next to continue.

Click Next to continue and begin the Prerequisites Check.
Verify the Prerequisites Check result. Click Next to start the Domain Controller promotion process.

22. I have included the common Prerequisites warning information for your reference here.

Windows Server 2016 domain controllers have a default for the security setting named "Allow cryptography algorithms compatible with Windows NT 4.0" that prevents weaker cryptography algorithms when establishing security channel sessions.
For more information about this setting, see Knowledge Base article 942564 (http://go.microsoft.com/fwlink/?LinkId=104751).
This computer has at least one physical network adapter that does not have static IP address(es) assigned to its IP Properties. If both IPv4 and IPv6 are enabled for a network adapter, both IPv4 and IPv6 static IP addresses should be assigned to both IPv4 and IPv6 Properties of the physical network adapter. Such static IP address(es) assignment should be done to all the physical network adapters for reliable Domain Name System (DNS) operation.
A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain "labanddemo.com". Otherwise, no action is required.

23. Reboot the server after completing the DCPROMO process. After the restart, the new Windows Server 2016 will be an additional domain controller in your existing domain. The Schema will be upgraded to Windows Server 2016.
I believe this is good for Part-1 of this blogs series. In Part-2, my plan to focus more on Active Directory related functionalities. Please post a comment here if you like to see an particular topic in this blog series.

Part1 - Windows Server 2016 – Active Directory
Part 2 - Windows Server 2016 – Active Directory – Temporary Group Memberships

Microsoft Advanced Threat Analytics (ATA) - Attack Simulation and Demo

noreply@blogger.com (Blog-5) — Wed, 05 Oct 2016 07:00:00 +0000

Microsoft Advanced Threat Analytics (ATA) is an user and entity behavior analytics solution to identify and protect protect organizations from advanced targeted attacks (APTs). You can read more information about Microsoft Advanced Threat Analytics (ATA) here. The purpose of this blog is to provide a few methods which can be used to simulate and demonstrate some of the basic attacks for demo and testing purpose.
Suspicious Activity Simulation #1 – ATA Gateway Stopped Communicating
We will start with the most obvious one! – ATA communication issue. In this scenario, I am using ATA Light Weight Gateway(LWGW). In this case Microsoft Advanced Threat Analytics Gateway (ATAGateway) service should be running on Domain Controllers.
To simulate this scenario,

Identify all Domain Controllers from the forest/domain. You can use the following DSQUERY command to get all DCs from the domain.
- DsQuery Server -Forest
Stop the ATAGateway service remotely
- Here are a few scripts - Script1 or Script2 or Script3 – if you want to go a script based approach
- Or we can use a simple SC command – SC \\Lab-DC01 stop ATAGateway

You will receive the following high alert – ATA Gateway Stopped Communicating – in Health Center.

Suspicious Activity Simulation #2- Honey Token Account Activities
In general, the Honey Token accounts are non-interactive accounts. These accounts can be dummy accounts for detect malicious activities.
To simulate this scenario,

Create two 2 user accounts in Active Directory (ATA-Test1 and ATA-Test2)
Add ATA-Test2 to Domain Admins group
Get the SID of ATA-Test1 and ATA-Test2 using PowerShell or DSQUERY command
- dsquery * -filter (samaccountname=ata-test1) -attr objectsid (Reference)
- Get-ADUser Ata-test1 -Properties objectSID (Reference)
Add this SID as Honey token accounts (ATA Console –> Configuration –> Detection –> Honeytoken Account SIDs). Save the configuration.
Establish an integrative logon session using these accounts. You can RDP into a machine use these accounts

Honey Token accounts (non-sensitive)
You will receive the following alert/email with recommended actions in the ATA console.

Honey Token accounts (Sensitive)
Since ATA-Test2 account is a domain admin account, you will receive the same alert with "Sensitive (S )" indicating that this account is a high privileged account in Active Directory.

Suspicious Activity Simulation #3 – Massive Object Deletion
Bulk object deletion can be a suspicious activity in an Active Directory environment. ATA can alert alert you based on massive object deletion activities.
To simulate this scenario,

Create a few users in Active directory. Here is a sample PowerShell script which you can use to create test accounts in Active Directory

Clear
Import-module activedirectory
$pass = ConvertTo-SecureString "MyPassword0!" –asplaintext –force
for ($i=0;$i -lt 100;$i++)
{
$accountname = "Test-Account$i"
Write-Host "Creating $accountname" -NoNewline
New-ADUser –SamAccountName $accountname –name $accountname -OtherAttributes @{'description'="ATA Test User Account"} -Path "OU=Test Accounts,OU=User Accounts,DC=labanddemo,DC=com"
Set-ADAccountPassword –identity $accountname –NewPassword $pass
Write-Host "...Done"
}

Make sure ATA is "learned" about these account.
Delete these accounts from Active Directory

You will receive the Massive Object Deletion alert in the ATA console right away as shown below.

Suspicious Activity Simulation #4 - Reconnaissance using DNS
The DNS or name resolution information in a network would be useful reconnaissance information. In general, DNS data contains a list of all the servers and workstations and the mapping to their IP addresses. Verifying this information may provide attackers with a detailed view of the environment allowing attackers to focus their efforts on the relevant entities.
For this simulation, the plan is to perform a DNS zone lookup using NSLOOKUP LS command.
To simulate this scenario,

Logon to a remote server.
Open Command Prompt and run NSLOOKUP command
From the NSLOOKUP window, run LS command to list the DNS zone

You will receive the following Reconnaissance using DNS alert the ATA console.

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server

noreply@blogger.com (Blog-5) — Tue, 05 Jul 2016 07:00:00 +0000

Related Blogs:

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/06/configuring-yubikey-yubico-oath-token.html

Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Requirements:

The following are the pre-requirements to complete this configuration.

Microsoft Azure MFA on-premises server
Deepnet SafeID hardware
Secret Key for your DeepNet SafeID. You will receive an email with Secret Key after the purchase.

Review the following Azure MFA Server Authentication Types blog if you are not familiar with authentication configuration in Azure MFA Server:

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Azure MFA Server – Configuration for third Party OATH

First step in this process is to add third party OATH Tokens in Azure MFA Server. You can either add these tokens individually or perform a bulk import using an input file.

To add an OATH token,

Logon to your MFA application server. Open Multi-Factor Authentication Server UI and Select OATH Token icon.
Click Add option from OATH Token window.
Enter your Secret Key token Details
1. Serial Number – Required. Enter the serial number of your SafeID. This will be in the back of the Secret Keyas shown below or it will be the email you received from DeepNet.
3. Secret Key – Required. This is the Secret Key (Base32). You have to receive this information from DeepNet. You will receive an email from Deepnet with Secret Key after the purchase
4. Manufacturer – Optional. Enter DeepNet Security as the manufacturer.
5. Model – Optional. Enter SafeID as model type.
6. Start date – Optional
7. Expiration date – Optional
8. Time interval – Required. Select 60 seconds.
9. Username: Associate a user with this OATH token. You can manually enter the username or Select User option to identify a user.
11. Click OK to complete. The Synchronize OATH Token dialog will prompt for the current OATH code to synchronize the OATH token and verify the configuration.
13. Enter the current code from DeepNet SafeID from the Synchronize OATH Token window to complete token configuration in MFA Server. Click OK.

Sample Input File

To perform a bulk import,

Note3: you may receive the following error message when you click on Import button. There is an update/hotfix for this issue.

Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.

Azure MFA Server – End User Validation Using DeepNet SafeID OATH Token

The final step in this process is to validate the DeepNet SafeID configuration and authentication experience from an end user perspective.

To configure OATH token as the authentication type for an end user:

From Multi-Factor Authentication Server UI, Select Users icon
From right pane, open the user properties by double clicking the user object.
This will open User Properties / Edit User window as shown below. Make sure that the OATH Token is selected as the authentication type for this test user.
To validate this configuration, select out test user object and from the bottom of the window, select Test option.
User will be prompted for first /primary authentication using a user name and password. Enter the User name and Password for the user, then click Test.
Then it will prompt you for the secondary authentication. In this scenario, it the OATH Code.
Get the current OATH code from your DeepNet SafeID.
Enter the current code in the OATH Code window in the MFA application . Click OK.
You will see the authentication status/result as shown below:

Related Blogs:

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/06/configuring-yubikey-yubico-oath-token.html

Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Configuring YubiKey / Yubico OATH Token with Microsoft Azure MFA Server

noreply@blogger.com (Blog-5) — Mon, 27 Jun 2016 07:00:00 +0000

Related blogs:

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/07/configuring-deepnet-security-safeid.html

Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Requirements:

The following are the pre-requirements to complete this configuration.

YubiKey Personalization Tool – Installation and Configuration

The YubiKey Personalization Tool can be used to program the two configuration slots. Also, it can be used to personalize the YubiKey in the following modes:

Yubico OTP
OATH-HOTP
Static Password
Challenge-Response

Download YubiKey Personalization Tool and run yubikey-personalization-gui-3.1.24.exe file to compete the tool installation.

Insert YubiKey into the USB port. You may see the Device Setup windows as shown below. Complete the drive installation process.
Open YubiKey Personalization Tool. Make sure:
1. YubiKey Personalization Tool has successfully identified your YubiKey.
3. Yubico OTP displayed as supported method in Features Supported section.
You will see all the current OTP configuration in Yubico OTP tab shown below. I am going to a use the default configuration for this testing.

YubiCo Authenticator Application – Installation and Configuration

Download YubiCo Authenticator Application and run yubioath-desktop-3.0.1-win.exe file to complete the application installation.

Open YubiCo Authenticator Application
From File menu, select Add option (File –> Add)
From the New Credential window:
1. Enter Credential Name – An identifier or a display name for the credential.
2. Secret Key – It is a Base32 key. Review this If you are not familiar with supported numbers or characters in Base32 encoding.
3. Select Time based (TOTP) option. Microsoft Azure MFA server supports only the OATH TOTP (time-based) tokens.
4. Number of digits – You can select 6 or 8 digits as OATH token length.
6. Require touch - If you select this option, end user has to touch the YubiKey to generate an OATH token. User will prompted with the following message:
8. Click OK to save the configuration
10. You will see the newly add account in the Yubico Authenticator window.

Now we have completed the YubiKey account configuration. We can move on to Azure MFA server to configure the OATH token.

Azure MFA Server - Configuration for third Party OATH

Review the following Azure MFA Server Authentication Types blog if you are not familiar with authentication configuration in Azure MFA Server:

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

To add OATH Token in Azure MFA Server,

Open Multi-Factor Authentication Server UI and Select OATH Token icon.
Click Add option from OATH Token window.
Enter your YubiKey token Details
1. Serial Number – Required. Enter the YubiKey serial number. This will be in the back of the Yubikey as shown below:
3. Secret Key – Required. This is the Secret Key (Base32) you have configured using the Authentication Application.
4. Manufacturer – Optional. Enter Youbico as the manufacturer.
5. Model – Optional. Enter your YubiKey model type.
6. Start date – Optional
7. Expiration date – Optional
8. Time interval – Required. You can select the default 30 seconds value. By default, YubiKey changes the 6-8 digit code every 30 seconds.
9. Username: Select the user for this OATH token. You manually enter the username or Select User option to identify a user.
10. Click OK to complete. The Synchronize OATH Token dialog will prompt for the current OATH code to synchronize the OATH token and verify the configuration.
12. Generate a new OATH from Yubico Authentication app using the button.
14. Enter this code in the Synchronize OATH Token window to complete token configuration in MFA Server.

Sample Input File

To perform a bulk import,

Select OATH Token icon and select Import.
Select the input file and click Import.

Note3: you may receive the following error message when you click on Import button. There is an update/hotfix for this issue.

Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.

Azure MFA Server – End User Validation Using YubiKey OATH Token

The final step in this process is to validate the YubiKey configuration and authentication experience from an end user perspective.

To configure OATH token as the authentication type for an end user:

From Multi-Factor Authentication Server UI, Select Users icon
From right pane, open the user properties by double clicking the user object.
This will open User Properties / Edit User window as shown below. Make sure that the OATH Token is selected as the authentication type for this test user.
To validate this configuration, select out test user object and from the bottom of the window, select Test option.
User will be prompted for first /primary authentication using a user name and password. Enter the User name and Password for the user, then click Test.
Then it will prompt you for the secondary authentication. In this scenario, it the OATH Code.
To generate a new OATH code, open Yubico Authenticator App and pressing the button . The OATH code will be displayed as shown below:
Enter the current OATH code in the OATH Code in the MFA application window. Click OK.
You will see the authentication status/result as shown below:

Related blogs:

Configuring Deepnet Security SafeID OATH Token with Microsoft Azure MFA Server - http://portal.sivarajan.com/2016/07/configuring-deepnet-security-safeid.html

Azure MFA with pGina and Local Authentication - http://portal.sivarajan.com/2015/09/azure-mfa-with-pgina.html

Azure MFA Server –Authentication Types (Part I) - http://portal.sivarajan.com/2016/05/azure-mfa-serverauthentication-type.html

Azure MFA Server –Authentication Types (Part II) - http://portal.sivarajan.com/2016/06/azure-mfa-server-authentication-type.html

Advanced Threat Analytics–Attack Simulation and Demo–Part1

noreply@blogger.com (Blog-5) — Thu, 23 Jun 2016 07:00:00 +0000

Advanced Threat Analytics–Attack Simulation and Demo–Part1

Advanced Threat Analytics–Attack Simulation and Demo–Part2

Advanced Threat Analytics–Attack Simulation and Demo–Part3

Suspicious Activity Simulation #1 – ATA Gateway Stopped Communicating

We will start with the most obvious one! – ATA communication issue. In this scenario, I am using ATA Light Weight Gateway (LWGW). In this case Microsoft Advanced Threat Analytics Gateway (ATAGateway) service should be running on Domain Controllers.

To simulate this scenario,

Identify all Domain Controllers from the forest/domain. You can use the following DSQUERY command to get all DCs from the domain.
- DsQuery Server -Forest
Stop the ATAGateway service remotely
- Here are a few scripts - Script1 or Script2 or Script3 – if you want to go a script based approach
- Or we can use a simple SC command – SC \\Lab-DC01 stop ATAGateway

You will receive the following high alert – ATA Gateway Stopped Communicating – in Health Center.

Suspicious Activity Simulation #2- Honey Token Account Activities

In general, the Honey Token accounts are non-interactive accounts. These accounts can be dummy accounts for detect malicious activities.

To simulate this scenario,

Create two 2 user accounts in Active Directory (ATA-Test1 and ATA-Test2)
Add ATA-Test2 to Domain Admins group
Get the SID of ATA-Test1 and ATA-Test2 using PowerShell or DSQUERY command
- dsquery * -filter (samaccountname=ata-test1) -attr objectsid (Reference)
- Get-ADUser Ata-test1 -Properties objectSID (Reference)
Add this SID as Honey token accounts (ATA Console –> Configuration –> Detection –> Honeytoken Account SIDs). Save the configuration.
Establish an integrative logon session using these accounts. You can RDP into a machine use these accounts

Honey Token accounts (non-sensitive)

You will receive the following alert/email with recommended actions in the ATA console.

Honey Token accounts (Sensitive)

Since ATA-Test2 account is a domain admin account, you will receive the same alert with "Sensitive (S )" indicating that this account is a high privileged account in Active Directory.

Suspicious Activity Simulation #3 – Massive Object Deletion

Bulk object deletion can be a suspicious activity in an Active Directory environment. ATA can alert alert you based on massive object deletion activities.

To simulate this scenario,

Create a few users in Active directory. Here is a sample PowerShell script which you can use to create test accounts in Active Directory

Clear
Import-module activedirectory
$pass = ConvertTo-SecureString "MyPassword0!" –asplaintext –force
for ($i=0;$i -lt 100;$i++)
{
$accountname = "Test-Account$i"
Write-Host "Creating $accountname" -NoNewline
New-ADUser –SamAccountName $accountname –name $accountname -OtherAttributes @{'description'="ATA Test User Account"} -Path "OU=Test Accounts,OU=User Accounts,DC=labanddemo,DC=com"
Set-ADAccountPassword –identity $accountname –NewPassword $pass
Write-Host "...Done"
}

Make sure ATA is "learned" about these account.
Delete these accounts from Active Directory

You will receive the Massive Object Deletion alert in the ATA console right away as shown below.

Suspicious Activity Simulation #4 - Reconnaissance using DNS

For this simulation, the plan is to perform a DNS zone lookup using NSLOOKUP LS command.

To simulate this scenario,

Logon to a remote server.
Open Command Prompt and run NSLOOKUP command
From the NSLOOKUP window, run LS command to list the DNS zone

You will receive the following Reconnaissance using DNS alert the ATA console.

Advanced Threat Analytics–Attack Simulation and Demo–Part1

Advanced Threat Analytics–Attack Simulation and Demo–Part2

Advanced Threat Analytics–Attack Simulation and Demo–Part3

Azure – Custom NameId Support in SAML Attribute

noreply@blogger.com (Blog-5) — Tue, 17 May 2016 07:00:00 +0000

Now Azure supports extension attributes (1-15) as Name Identifier (nameid) in SAML token. This option is available for both Gallery and Custom applications.

Using the Claims Editor, now you can select, Extension Attributes 1 –10 as the unique identifier.

Previously, we had only a few attribute options (user.mail , user.onpremisessamaccountname , user.userprinciplenae and ExtractMailPrefix() fuciton) as name identifier. We couldn’t use any custom values using extension attribute.