7MS #261: Blind Network Security Assessments
This week I had the fun opportunity to do a "blind" network security assessment - where basically we had to step into a network we'd never seen before and make some security posture recommendations. I've found that the following software/hardware is quite helpful for this type of assessment:
Network Detective will do a ton of helpful Active Directory enumeration and point out potential red flags, such as:
- Accounts that haven't been logged into for a long time
- Accounts with passwords that haven't been refreshed in a long time
- Privileged groups that need review (Domain Admins, Enterprise Admins, etc.)
AD policy issues (*warning: by default Network Detective only pulls back a few policies by default. Check out scripts such as my Environment Check to grab a dump of all GPOs.