search

MichaelGrafnetter / DSInternals

Directory Services Internals (DSInternals) PowerShell Module and Framework
https://www.dsinternals.com
MIT License
1.62k stars 250 forks source link

Support for remote call #147

Closed arsalanaltaf432 closed 1 year ago

arsalanaltaf432 commented 1 year ago

I'm working on Active Directory password synchronization using DSInternals. It's working perfectly in the local call. I want to know either DSInternals support remote calls for

If it supports it, how can we connect to the DSInternals module remotely using PowerShell?

MichaelGrafnetter commented 1 year ago

My advice is that you should not do it in the first place, as Set-SamAccountPasswordHash does not support Kerberos keys because of API limitations. And I would definitely not implement it in PowerShell, but I would instead use C# with DSInternals NuGet packages. But to answer your question, both Get-ADReplAccount and Set-SamAccountPasswordHash can connect to remote DCs if you provide a DC name and if you have the permissions required.

arsalanaltaf432 commented 1 year ago

Thanks, Michael. I'll get back to you if I have any other queries.

CamFlyerCH commented 1 year ago

@arsalanaltaf432 I built a password synchronization years ago using DS-Internals and it was very useful in some AD to AD migration projects. But there is also a big issue: When the NTLM password hash is written to an account, the AES hashes are gone and there are none. The user can use the synced password to login, but when he want to change it (for example via Ctrl, Alt & Del) he receives an encryption error message. To perform the password change the AES keys are needed. I am not sure from witch OS Version this was mandatory, but synchronized NTLM hashes for normal users was not an option anymore. It could work for other use cases, but I agree with Michael, that this is not a good option.

Regarding password sync: To facilitate AD to AD migration projects regarding user passwords, I developed a password synchronization based on a password filter DLL on the domain controller to "grab" the password during a password change and write it to the new domain. The write is done via a PowerShell script that first performs different checks and filtering (find target account, check if AdminCount is not 1 and some more specialized filtering to avoid looping in an bidirectional sync scenario.) Since this was developed for my company I can't share this publicly. But these These projects inspired me: https://sourceforge.net/projects/passwdhk/ https://github.com/raandree/ManagedPasswordFilter https://github.com/GoSecure/DLLPasswordFilterImplant

arsalanaltaf432 commented 1 year ago

@arsalanaltaf432 I built a password synchronization years ago using DS-Internals and it was very useful in some AD to AD migration projects. But there is also a big issue: When the NTLM password hash is written to an account, the AES hashes are gone and there are none. The user can use the synced password to login, but when he want to change it (for example via Ctrl, Alt & Del) he receives an encryption error message. To perform the password change the AES keys are needed. I am not sure from witch OS Version this was mandatory, but synchronized NTLM hashes for normal users was not an option anymore. It could work for other use cases, but I agree with Michael, that this is not a good option.

Regarding password sync: To facilitate AD to AD migration projects regarding user passwords, I developed a password synchronization based on a password filter DLL on the domain controller to "grab" the password during a password change and write it to the new domain. The write is done via a PowerShell script that first performs different checks and filtering (find target account, check if AdminCount is not 1 and some more specialized filtering to avoid looping in an bidirectional sync scenario.) Since this was developed for my company I can't share this publicly. But these These projects inspired me: https://sourceforge.net/projects/passwdhk/ https://github.com/raandree/ManagedPasswordFilter https://github.com/GoSecure/DLLPasswordFilterImplant

Thanks, @CamFlyerCH an important point, I'll have a look into that.