Open yanncam opened 2 years ago
Hello @yanncam , the mail
and pwdLastSet
attributes are indeed not retrieved by DSInternals cmdlets. The original purpose of DSInternals was the decryption of secret attributes, which are never exposed through LDAP.
Other methods can be used to read these standard attributes:
That being said, I might add support for these attributes in a future version of DSInternals.
Hello @MichaelGrafnetter, than you for the quick answer.
I understand that the objective of DSInternals is towards the secrets sequestered in the AD, it is not a classic LDAP / AD browser of course.
A definite advantage of DSInternals is that it is notably able to extract information from an AD in offline mode (via the ntds.dit) or in online mode.
When we talk about secrets, and in particular LM / NTLM hashes, DSInternals is already very well equipped to extract them, their history, compare them to the HaveIBeenPwned database with the "Test Password Quality", etc.
However, from all these functions, it is not possible to extract the lastPwdSet
or the mail
.
Why do I think these two attributes are of interest regarding secrets?
lastPwdSet
is interesting to identify the accounts which derogate from this renewal policy precisely.lastPwdSet
is also useful for gauging accounts whose password never expires. Of course, they are set to never expire, but a password that has not been changed for +10 years or even + 20 years would still have to be checked to avoid a compromise.lastLogon
, lastLogonTimestamp
and lastLogonDate
, so in my opinion the lastPwdSet
is in the same logic.For me these attributes have a real interest during the analysis of secrets, precisely to take concrete actions against these accounts subsequently.
Yes, I agree, other standard AD query tools (online) would make it possible to retrieve these elements but would require cross-checking the results, making data crossovers between DSInternals and the tools, with risks correlation errors.
If DSInternals integrated these two attributes directly, that would greatly facilitate the task, especially in the event of forensic analysis on an offline ntds.dit following a compromise of an Active Directory ecosystem for example.
Thank you for your interest and have a nice day,
yanncam Good reasoning, added to my backlog.
👍 ! Thank you for consider it :) !
Hello,
I open an issue for enhancement. I have check issues (open/closed) and made some tests with
Get-ADDBAccount
andGet-ADReplAccount
but I can't retrieve the following user account's attributes that I need :mail
: the corporate email of the identity specified stored in the Active DirectorylastPwdSet
: the timestamp of the last update of the passwordAs example, from an
ntds.dit
file, I have tried:In this example, there is the
LastLogonDate
attribute (obviously empty for krbtgt, but not for other users). But no "LastPwdSet" nor "mail".When I pipe the previous command and
select *
, some others attributes are available:In the previous output, we can see the new
LastLogonTimestamp
orLastLogon
attributes available. But noLastPwdSet
normail
.Same with the pipe
| Format-List -Property *
.Get-ADDBAccount
andGet-ADReplAccount
(or I'm totaly blind 😎) ?LastPwdSet
andmail
attributes viaGet-ADDBAccount
andGet-ADReplAccount
?Thank you again for your great work,
Sincerely,