PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Enable SMB Signing via GPO

projectblack.io | research | #active-directory | #windows | #hardening | #ntlm-relay | #gpo | #smb-signing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Why 'SMB Signing not required' deserves attention: without signing, NTLM relay attacks grant access without cracking passwords. A GPO guide to enabling and requiring signing on servers and clients.
Published
Collected

Related coverage

blog · semperis.com
How to Defend Against an NTLM Relay Attack
NTLM relay exploits the protocol's lack of mutual authentication: attackers capture and relay authentication sessions to other services, as in PetitPotam. Covers detection and SMB-signing defenses.
blog · semperis.com
AD Security 101: Lock Down Risky User Rights
User rights assigned via GPOs—debug programs, back up files, take ownership, and more—become risky when misassigned. Explains how to review and lock down dangerous user rights in Active Directory.
blog · semperis.com
AD Security 101: GPO Logon Script Security
GPO logon scripts automate logon tasks, but sprawling, poorly maintained GPO structures invite abuse. Covers how scripts work (scripts.ini) and how to secure them.
blog · semperis.com
AD Security 101: Domain Controller Security
DC security essentials: promotion changes a server's logon model and access must be tightly restricted. GPOs linked to the Domain Controllers OU affect all DCs, so mistakes are high-impact.
research · projectblack.io
Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled
Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.
research · projectblack.io
Password Policy GPO
After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.
Back