MS updated key concepts in Windows LAPS

Microsoft changed the key concept for LAPS. 

New Policies, LAPS for Windows, LAPS in Azure AD etc.

Check out the following Link:

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-concepts

Workaround for Windows 10 SeriousSAM vulnerability

This vulnerability can let attackers gain admin rights on vulnerable systems and execute arbitrary code with SYSTEM privileges. Affected Systems are all OS released since October 2018, starting with Windows 10 1809 and Windows Server 2019.

Restrict access to the contents of %windir%\system32\config:

1. Open Command Prompt or PowerShell as an administrator.
2. Run this command:
• Command Prompt: icacls %windir%\system32\config\*.* /inheritance:e
•  Windows PowerShell: icacls $env:windir\system32\config\*.* /inheritance:en

And deleting Volume Shadow Copies!

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

Troubleshooting time sync issues on a AD domain computer

Most time there should be warning events in the System event log, with a source called Time-Service. 

To verify network connection and ntp settings you can use w32tm.

show source server:

w32tm /query /source

verify network connectivity to an NTP server:

w32tm /stripchart /computer:ntp01.mydomain.zz

show configuration:

w32tm /query /configuration

(NT5DS using domain hierarchy)

force client to use domain hierarchy:

w32tm /config /syncfromflags:domhier /update

Get Zerlologons CVE-2020-1472 using PowerShell

Find attached a script to get all systems that using zerologon (event 5829) described in CVE-2020-1472. I want to upload this script to my technet gallery, but MS changed it all so I cant acces it...

More infos about this topic and how to handle the update process:

https://support.microsoft.com/en-us/topic/how-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73cd1a11e

You can change the event to find other objects like trusts etc.

# --------------------------------------------------------------------------------------------------------
# Author: Tim Buntrock
# Script: Get_ZeroLogons5829.ps1
# Description: Get all machinesamaccountnames that appear in Event 5829, to find systems using zerologon!
# --------------------------------------------------------------------------------------------------------


# Prepare Variables
Param (
        [parameter(Mandatory=$false,Position=0)][String]$DCName = "localhost",
        [parameter(Mandatory=$false,Position=1)][Int]$Minutes = 15)

# Create an Array to hold the values
$InsecureNetLogons = @()

# Grab the appropriate events
$Events = Get-WinEvent -ComputerName $DCName -FilterHashtable @{Logname='System';Id=5829; StartTime=(get-date).AddMinutes("-$Minutes")}

# Loop through each event
ForEach ($Event in $Events) {
    $eventXML = [xml]$Event.ToXml()
    $Client = ($eventXML.event.EventData.Data[0]) #get Machinesamaccountname
    # Add Them To a Row in our Array
    $Row = "" | select Client
    $Row.Client =$Client
    # Add the row to our Array
    $InsecureNetLogons += $Row    
}

# Dump it all out to a CSV and open gridview
Write-Host $InsecureNetLogons.Count "records found ... saving unique entries to .\InsecureNetLogons.csv for DC" $ComputerName -ForegroundColor DarkYellow
$InsecureNetLogons | Sort-Object -Unique -Property Client| Export-CSV -NoTypeInformation .\InsecureNetLogons.csv
$InsecureNetLogons | Sort-Object -Unique -Property Client| Out-GridView

Enabling debug logging for the Netlogon service

Activate debug logging using nltest and set log size using registry

Type the following command, and then press Enter to enable logging:

Nltest /DBFlag:2080FFFF

 

Setting the maximum log file size for Netlogon logs using Registry

The MaximumLogFileSize registry entry can be used to specify the maximum size. You must create this entry, because it doesn´t exist.

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Value Name: MaximumLogFileSize

Value Type: REG_DWORD

Value Data: <max log file size in bytes>

1073741824 Bytes is 1 GB

This registry setting specify the disk space for the Netlogon.log and Netlogon.bak file. For example, a setting of 1 GB can require 2 GB of disk space.

Using Policy to enable logging and configuring log size

You can use the following Computer policy to configure the log file size in bytes and debug level:

Computer Configuration\Administrative Templates\System\Net Logon\Specify maximum log file size

1073741824  (1073741824 is 1 GB)

Computer Configuration\Administrative Templates\System\Net Logon\Specify log file debug output level

545325055     (545325055 is equivalent to 0x2080FFFF and enables verbose Netlogon logging!)