Hacks Weekly #1: Group Managed Service Accounts (gMSA) vs. Service Accounts and how to use them.

No video

Hacks Weekly #1: Group Managed Service Accounts (gMSA) vs. Service Accounts and how to use them.

Рет қаралды 36,649

CQURE Academy

Күн бұрын

Пікірлер: 31

@dieglhix 3 жыл бұрын

I didn't know this feature exist and I always wondered about Srv Accounts vulnerabilities but never investigated further. Thanks!

@CQUREAcademy 3 жыл бұрын

We're happy to help! :)

@mohamedwahieb474 Жыл бұрын

Thanks for informative video

@vsy7888 Жыл бұрын

very good tutorial - thank you for sharing!

@sunilchauhan9794 6 жыл бұрын

As always, Very Informative! Thanks, Paula!

@AbreTuMente 2 жыл бұрын

Great video!!! thank you so much!!!

@CQUREAcademy 2 жыл бұрын

Thank you!

@yanivshalomhelp3579 Жыл бұрын

Love U. Thanks

@fmkabuvideos 6 жыл бұрын

Interesting, I look forward to learning more.

@3r1ck87 5 жыл бұрын

Thanks, excellent video.

@mohammedmustaqueem8362 5 жыл бұрын

Thanks!

@zs2959 2 жыл бұрын

Hi, when you first run regedit, security hive was not expandable so you did not see the secrets but after the gsma, hive was changed. I was missing something ? thank you

@user-le4bi6bm9k 4 жыл бұрын

内容很棒，相见恨晚

@DannyNilsson 2 жыл бұрын

When trying to dump LSAA og access the data, windows defender will trigger alerts.

@chrisgaming5306 5 жыл бұрын

OMG, TY TY TY TY. Life saver.

@MOFITECH 2 ай бұрын

Good article Paula! Where can we find the CQ Secrets Dumper? The link doesn't point to a downloadable file. Thanks.

@CQUREAcademy 2 ай бұрын

Hi, thank you for your kind words! We're glad you enjoyed the article. 🦝 You can find the CQ Secrets Dumper on our website: cqureacademy.com/blog/cqsecretsdumper/. In case of any questions let us know!

@osmaster3327 6 жыл бұрын

Great. Thank a lot

@jarves1231 3 жыл бұрын

The KDS root key is not replicated to other domain controlles?

@michalb1389 3 жыл бұрын

super Paula

@CQUREAcademy 3 жыл бұрын

Thank you!

@rahulpradhan2568 3 жыл бұрын

Hey Paula - All the tools on your sites are being flagged as virus/Malware etc by antivirus .

@CQUREAcademy 3 жыл бұрын

A lot of our tools publicly available are flagged as malicious by AV engines. It is nothing to worry about, but anyway it is always advisable to run such tools, demo executables or scripts in an isolated test virtual machine. Our things are frequently flagged as malicious, because in our tools while playing with Windows security, we are sometimes performing operations similar to malware. Therefore behaviour pattern of such executables often looks very similar to malware. If you would like to complete the assessment, please whitelist some folder within your virtual machine or completely disable the anti-virus. Also, be sure NOT to use WinZip for our extracting files.

@rahulpradhan2568 3 жыл бұрын

@@CQUREAcademy Thanks for the info. Testing it in my lab environment. Appreciate your quick response !!

@InayetHadi 5 жыл бұрын

When a Powershell script needs admin rights to run how would you designate the service account in the powershell script that requires admin privilage?

@EugenNiedaszkowski 7 жыл бұрын

Wow! That was neat! Paula, may I ask you to tell more about SPNs in your next video?

@pdc0302 3 жыл бұрын

Thanks Paula! How do you define multiple server on the "New-ADServiceAccount -PrincipalsAllowToRetrieveManagedPassword" statement? do you use comma or semicolons?

@CQUREAcademy 3 жыл бұрын

That's such a great question! The parameter is an array, you can use comma separated values: Set-ADServiceAccount [-Identity] ITFarm1 -PrincipalsAllowedToRetrieveManagedPassword Host1$,Host3$ but best practice is to use group membership Set-ADServiceAccount [-Identity] ITFarm1 -PrincipalsAllowedToRetrieveManagedPassword AD_Group_Name

@pdc0302 3 жыл бұрын

@@CQUREAcademy Thank you!

@tamilankalaigal2 8 ай бұрын

@@CQUREAcademy wat is [-Identity] ITFarm1