Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Hacking > Active Directory Basics > Flashcards

Active Directory Basics Flashcards

Different Active Directory Concepts

1
Q

Whats an Object in AD?

A

An object can be defined as ANY resource present within an Active Directory environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Whats a Schema in AD?

A

In Active Directory, the schema defines the structure of the directory, including the object classes (e.g., user, group) and their attributes (e.g., name, email). It governs how data is stored and organized in AD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Whats an Attribute in AD?

A

Every object in Active Directory has an associated set of attributes used to define characteristics of the given object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Whats a domain in AD?

A

A domain is a logical group of objects such as computers, users, OUs, groups, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Whats a Forest in AD?

A

A forest is a collection of Active Directory domains. It is the topmost container and contains all of the AD objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Whats a Tree in AD?

A

A tree is a collection of Active Directory domains that begins at a single root domain. A forest is a collection of AD trees. Each domain in a tree shares a boundary with the other domains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Whats a Container in AD?

A

Container objects hold other objects and have a defined place in the directory subtree hierarchy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Whats a leaf in AD?

A

Leaf objects do not contain other objects and are found at the end of the subtree hierarchy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to find an object in AD?

A

Query for its objectGUID value using PowerShell or search for it by specifying its distinguished name, GUID, SID, or SAM account name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Whats a SID in AD?

A

A security identifier, or SID is used as a unique identifier for a security principal or security group. A SID can only be used once.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Whats a DN in AD?

A

A distinguished name is unique identifier that specifies the object’s location within the Active Directory (AD) hierarchy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Whats a RDN in AD?

A

A Relative Distinguished Name (RDN) is a single component of the Distinguished Name that identifies the object as unique from other objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where must DNs and RDNs be unique?

A

A DN must be unique in a directory.
An RDN must be unique in an OU.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Whats a sAMAccountName in AD?

A

The sAMAccountName is the user’s logon name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Whats a userPrincipalName in AD?

A

The userPrincipalName attribute is another way to identify users in AD. This attribute consists of a prefix (the user account name) and a suffix (the domain name) in the format of bjones@inlanefreight.local. This attribute is not mandatory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Global Catelog in AD?

A

A global catalog (GC) is a domain controller that stores copies of ALL objects in an Active Directory forest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two roles of the Global Catelog in AD?

A

Authorization and Object Search.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Whats a RODC?

A

A Read-Only Domain Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Whats the point of a RODC?

A

Has a read-only Active Directory database. No AD account passwords are cached on an RODC (other than the RODC computer account & RODC KRBTGT passwords.) No changes are pushed out via an RODC’s AD database, SYSVOL, or DNS. RODCs also include a read-only DNS server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Replication in AD?

A

AD objects are updated and transferred from one Domain Controller to another. Whenever a DC is added, connection objects are created to manage replication between them. These connections are made by the Knowledge Consistency Checker (KCC) service, which is present on all DCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a Service Principal Name in AD?

A

An SPN uniquely identifies a service instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is GPO in AD?

A

Group Policy Objects (GPOs) are virtual collections of policy settings. Each GPO has a unique GUID. A GPO can contain local file system settings or Active Directory settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Whats an ACL in AD?

A

An Access Control List (ACL) is the ordered collection of Access Control Entries (ACEs) that apply to an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Whats an ACE in AD?

A

Each Access Control Entry (ACE) in an ACL identifies a trustee (user account, group account, or logon session) and lists the access rights that are allowed, denied, or audited for the given trustee.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are DACLs in AD?

A

DACLs define which security principles are granted or denied access to an object; it contains a list of ACEs. When a process tries to access a securable object, the system checks the ACEs in the object’s DACL to determine whether or not to grant access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are SACLs in AD?

A

Allows for administrators to log access attempts that are made to secured objects. ACEs specify the types of access attempts that cause the system to generate a record in the security event log.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Whats a FQDN in AD?

A

An FQDN is the complete name for a specific computer or host. It is written with the hostname and domain name in the format [host name].[domain name].[tld].

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a Tombstone in AD?

A

A tombstone is a container object in AD that holds deleted AD objects. When an object is deleted from AD, the object remains for a set period of time known as the Tombstone Lifetime, and the isDeleted attribute is set to TRUE. Once an object exceeds the Tombstone Lifetime, it will be entirely removed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Whats the AD recycle bin?

A

It facilitates the recovery of deleted AD objects. This made it easier for sysadmins to restore objects, avoiding the need to restore from backups. Most of a deleted object’s attributes are preserved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the SYSVOL folder or share in AD?

A

stores copies of public files in the domain such as system policies, Group Policy settings, logon/logoff scripts, and often contains other types of scripts that are executed to perform various tasks in the AD environment. The contents of the SYSVOL folder are replicated to all DCs within the environment using File Replication Services (FRS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the dsHeuristics attribute in AD?

A

A string value set on the Directory Service object used to define multiple forest-wide configuration settings. One of these settings is to exclude built-in groups from the Protected Groups list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the adminCount attribute in AD?

A

The adminCount attribute determines whether or not the SDProp process protects a user. If the value is set to 0 or not specified, the user is not protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is ADUC in AD?

A

ADUC is a GUI console commonly used for managing users, groups, computers, and contacts in AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is ADSI Edit in AD?

A

A GUI tool used to manage objects in AD. It provides access to far more than is available in ADUC and can be used to set or delete any attribute available on an object, add, remove, and move objects as well

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Whats the NTDS.DIT file in AD?

A

Its the heart of AD. Its a database that stores AD data such as information about user and group objects, group membership, and, most important to attackers and penetration testers, the password hashes for all users in the domain. . If the setting Store password with reversible encryption is enabled, then the NTDS.DIT will also store the cleartext passwords for all users created or who changed their password after this policy was set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What’s MSBROWSE in AD?

A

MSBROWSE is a Microsoft networking protocol that was used in early versions of Windows-based local area networks (LANs) to provide browsing services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Name some common AD objects

A

Users, Contacts, Printers, Computers, Shares, Groups, OUs, Domains, DCs, SItes,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Whats a site in AD?

A

A set of computers across one or more subnets connected using high-speed links. They are used to make replication across domain controllers run efficiently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Whats an FSP in AD?

A

A foreign security principal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Whats the purpose of FSPs in AD?

A

THey represent a security principal that belongs to a trusted external forest. They are created when an object from an external forest is added to a group in the current domain. They are created automatically after adding a security principal to a group. They are a placeholder object that holds the SID of the foreign object .Windows uses this SID to resolve the object’s name via the trust relationship.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the five Flexible Single Master Operation (FSMO) roles?

A

Schema Master, Domain Naming Master, Relative ID (RID) Master, PDC Emulator and Infrastructure Master

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the Schema Master FSMO role?

A

Manages the read/write copy of the AD schema, which defines all attributes that can apply to an object in AD.

42
Q

What is the Domain Naming Master FSMO role?

A

Manages domain names and ensures that two domains of the same name are not created in the same forest.

43
Q

What is the Relative ID (RID) Master FSMO role?

A

Assigns blocks of RIDs to other DCs within the domain that can be used for new objects. The RID Master helps ensure that multiple objects are not assigned the same SID. Domain object SIDs are the domain SID combined with the RID number assigned to the object to make the unique SID.

44
Q

What is the PDC Emulator FSMO role?

A

The host with this role would be the authoritative DC in the domain and respond to authentication requests, password changes, and manage Group Policy Objects (GPOs). The PDC Emulator also maintains time within the domain.

45
Q

What is the Infrastructure Master FSMO role?

A

Translates GUIDs, SIDs, and DNs between domains. This role is used in organizations with multiple domains in a single forest. The Infrastructure Master helps them to communicate. If this role is not functioning properly, Access Control Lists (ACLs) will show SIDs instead of fully resolved names.

46
Q

What are functional levels in AD?

A

Functional Levels in Active Directory define the features available based on the Windows Server version of the domain controllers. There are Domain Functional Levels and Forest Functional Levels.

47
Q

What kinds of trusts are there in AD?

A

Parent-child, Cross-link, External, Tree-root and Forest.

48
Q

What is a Parent-child trust in AD?

A

Domains within the same forest. The child domain has a two-way transitive trust with the parent domain.

49
Q

What is a Cross-link trust in AD?

A

A trust between child domains to speed up authentication.

50
Q

What is an External Trust in AD?

A

A non-transitive trust between two separate domains in separate forests which are not already joined by a forest trust. This type of trust utilizes SID filtering.

51
Q

What is a Tree-root trust in AD?

A

A two-way transitive trust between a forest root domain and a new tree root domain. They are created by design when you set up a new tree root domain within a forest.

52
Q

What is Forest trust in AD?

A

A transitive trust between two forest root domains.

53
Q

What is transitive trust in AD?

A

A trust relationship where if Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A also trusts Domain C. This type of trust allows trust to extend across multiple domains or forests.

54
Q

What is non-transitive trust in AD?

A

A trust that is limited to the two domains directly involved. If Domain A trusts Domain B, Domain A does not automatically trust any other domains that Domain B trusts.

55
Q

Whats a bidirectional trust in AD?

A

Users from both trusting domains can access resources.

56
Q

Whats a one way trust in AD?

A

Only users in a trusted domain can access resources in a trusting domain, not vice-versa. The direction of trust is opposite to the direction of access.

57
Q

Whats the first step of kerberos?

A

The user logs on, and their password is converted to an NTLM hash, which is used to encrypt the TGT ticket. This decouples the user’s credentials from requests to resources.

58
Q

Whats the seccond step of kerberos?

A

The KDC service on the DC checks the authentication service request (AS-REQ), verifies the user information, and creates a Ticket Granting Ticket (TGT), which is delivered to the user.

59
Q

Whats the third step of kerberos?

A

The user presents the TGT to the DC, requesting a Ticket Granting Service (TGS) ticket for a specific service. This is the TGS-REQ. If the TGT is successfully validated, its data is copied to create a TGS ticket.

60
Q

Whats the fourth step of kerberos?

A

The TGS is encrypted with the NTLM password hash of the service or computer account in whose context the service instance is running and is delivered to the user in the TGS_REP.

61
Q

Whats the fifth step of kerberos?

A

The user presents the TGS to the service, and if it is valid, the user is permitted to connect to the resource (AP_REQ).

62
Q

How long can a LM hash be?

A

14 characters

63
Q

What happens to a password before it is hashed with LM hash function?

A

It is converted to uppercase

64
Q

How does NTLM authentication work?

A

Client -> NEGOTIATE_MESSAGE
Server -> CHALLENGE_MESSAGE
Client -> AUTHENTICATE_MESSAGE

65
Q

What is MSCache2 in AD?

A

Domain cached credentials are where hosts save the last ten hashes for any domain users that successfully log into the machine in the HKEY_LOCAL_MACHINE\SECURITY\Cache registry key.

66
Q

What is the ‘Security’ group type in AD?

A

For ease of assigning permissions and rights to a collection of users instead of one at a time.

67
Q

What is the ‘Distribution’ group type in AD?

A

Used by email applications to distribute messages to group members. They function like mailing lists. Cannot be used to assign permissions to resources in a domain environment.

68
Q

What is the ‘Domain Local’ group scope in AD?

A

Can only be used to manage permissions to domain resources in the domain where it was created. Local groups cannot be used in other domains but CAN contain users from OTHER domains.

69
Q

What is the ‘Global’ group scope in AD?

A

Can be used to grant access to resources in another domain. Can only contain accounts from the domain where it was created. Global groups can be added to both other global groups and local groups.

70
Q

What is the ‘Universal’ group scope in AD?

A

Can contain users, groups, and computers from any domain within the same forest. Used for managing cross-domain resources. Changes trigger forest-wide replication. Best practice is to add global groups as members to reduce replication overhead.

71
Q

Under what condition can a global group be converted to a universal group?

A

If it is NOT part of another Global Group.

72
Q

Under what condition can a Domain Local Group be converted to a Universal Group?

A

If the Domain Local Group does NOT contain any other Domain Local Groups as members.

73
Q

Under what condition can a Universal Group be converted to a Global Group?

A

If it does NOT contain any other Universal Groups as members.

74
Q

Name some common attributes for a group object in AD

A

cn - common name
member - who is member of group
groupType - type and scope
memberOf - member of which groups
objectSid - SID of group

75
Q

Describe the ‘account operators’ builtin group

A

Members can create and modify most types of accounts, including those of users, local groups, and global groups, and members can log in locally to domain controllers

76
Q

Describe the ‘administrators’ builtin group

A

Members have full and unrestricted access to a computer or an entire domain if they are in this group on a Domain Controller

77
Q

Describe the ‘backup operators’ builtin group

A

Members can back up and restore all files on a computer, regardless of the permissions set on the files.

78
Q

Describe the ‘dns admins’ builtin group

A

Members have access to network DNS information

79
Q

Describe the ‘domain admins’ builtin group

A

Members have full access to administer the domain and are members of the local administrator’s group on all domain-joined machines.

80
Q

Describe the ‘enterprise admins’ builtin group

A

Membership in this group provides complete configuration access within the domain. The group only exists in the root domain of an AD forest

81
Q

Describe the ‘Group Policy Creator Owners’ builtin group

A

Members create, edit, or delete Group Policy Objects in the domain.

82
Q

Describe the ‘protected users’ builtin group.

A

Members of this group are provided additional protections against credential theft and tactics such as Kerberos abuse

83
Q

Describe the ‘SeRemoteInteractiveLogonRight’ privilege

A

This privilege could give our target user the right to log onto a host via Remote Desktop (RDP), which could potentially be used to obtain sensitive data or escalate privileges.

84
Q

Describe the ‘SeBackupPrivilege’ privilege

A

This grants a user the ability to create system backups and could be used to obtain copies of sensitive system files that can be used to retrieve passwords such as the SAM and SYSTEM Registry hives and the NTDS.dit Active Directory database file.

85
Q

Describe the ‘SeDebugPrivilege’ privilege

A

This allows a user to debug and adjust the memory of a process. With this privilege, attackers could utilize a tool such as Mimikatz to read the memory space of the Local System Authority (LSASS) process and obtain any credentials stored in memory.

86
Q

Describe the ‘SeImpersonatePrivilege’ privilege

A

This privilege allows us to impersonate a token of a privileged account such as NT AUTHORITY\SYSTEM. This could be leveraged with a tool such as JuicyPotato, RogueWinRM, PrintSpoofer, etc., to escalate privileges on a target system.

87
Q

Describe the ‘SeLoadDriverPrivilege’ privilege

A

A user with this privilege can load and unload device drivers that could potentially be used to escalate privileges or compromise a system.

88
Q

Describe the ‘SeTakeOwnershipPrivilege’ privilege

A

This allows a process to take ownership of an object. At its most basic level, we could use this privilege to gain access to a file share or a file on a share that was otherwise not accessible to us.

89
Q

How to view the privileges of the current user?

A

whoami /priv

90
Q

List some common group policies in AD

A

Account Policies
Local Policies
Software Restriction Policies
Application Control Policies
Advanced Audit Policy Configuration

91
Q

What is a Group Managed Service Account:

A

A GMSA is an account managed by the domain that offers a higher level of security than other types of service accounts for use with non-interactive applications, services, processes, and tasks that are run automatically but require credentials to run

92
Q

Which AD objects can group policy be applied to?

A

Computers and Users

93
Q

List some common group policies in AD

A

screen lock timeout
disabling USB ports
enforcing a custom domain password policy
installing software
managing applications
customizing remote access settings

94
Q

What is the oder of precedense in AD? LSDOU

A

The order that decides which group policies will take effect:
Local
Site
Domain
Organizational Unit – highest precedense

95
Q

What happens if there are no conflicts from any GPOs in the order of precedence?

A

A combination of all polciies apply.

96
Q

What happens if there are conflicts from any GPOs in the order of precedence?

A

The lowest policy in the order of precedence applies.

97
Q

What if there are conflicts and one GPO is ‘enforced’?

A

The enforced GPO will take precedence.

98
Q

What if a Default Domain Policy GPO is enforced?

A

Regardless of which GPO is set to enforced, if the Default Domain Policy GPO is enforced, it will take precedence over all GPOs at all levels.

99
Q

What if the Block inheritance option is set on an OU?

A

Policies higher up (such as at the domain level) will NOT be applied to this OU.

100
Q

How can we force a GPO update in AD with Powershell?

A

gpupdate /force

101
Q

Which piece of software allows for editing of GPOs

A

GPMC (Group Policy Management)

102
Q
A

Hacking (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions