Active Directory Effective Permissions - Paramount to Cyber Security

Folks,

If you're into Cyber Security, and you could read only one piece this year, you'll likely want to read this post - its that important.

[ Some Context: Here is the associated press release - Paramount Defenses Skips Black Hat Conference 2017 to Educate World About Importance of Active Directory Effective Permissions to their foundational cyber security. ]

Today, I'll shed light on Active Directory Effective Permissions, a most vital topic that Microsoft (for reasons best known to them) apparently completely forgot to educate the world about, for a decade, even though it is paramount to cyber security worldwide.

Privileged Access in Active Directory

It is Active Directory Effective Permissions that determine who has what privileged access at 1000s of organizations worldwide.


(By the way, I find it astounding that even 17 years after Active Directory was shipped, 1000s of Microsoft's major organizational customers still don't seem to know about something so fundamental to their foundational cyber security - Effective Permissions.)


This incredibly important post is a bit long so for enhanced readability, it is comprised of the following 12 sections-

This is Paramount A Simple $ Billion Example Active Directory Effective Permissions Their Importance

The Effective Permissions Tab A Huge Challenge What Organizations Need The Solution

The Answer A Note About Microsoft About Black Hat Conference Summary

This is Paramount

Let's begin by understanding why this is so relevant and paramount to the foundational cyber security of every organization.

Consider this. In an Active Directory deployment (the foundation of IT and cyber security at most organizations in the world,) do you know what is the only way to answer each & every one of the following 10 basic and elemental cyber security questions? -

1. Exactly who has what level of privileged access where and how in Active Directory?


2. Exactly who can create new user accounts, security groups, OUs, SCPs etc. in Active Directory?


3. Exactly who can delete existing user accounts, security groups, OUs, SCPs, etc. in Active Directory?


4. Exactly who can reset the password of which user accounts (including privileged users) in Active Directory?


5. Exactly who can modify the membership of which groups (including all privileged groups) in Active Directory?


6. Exactly who can modify the ACL of the AdminSDHolder object to control all privileged access in Active Directory?


7. Exactly who can modify the contents of the Configuration and Schema partitions to gain control of Active Directory?


8. Exactly who can manage all accounts, computers, groups, OUs, DCs, SCPs, Trust relationships etc. in Active Directory?


9. Exactly who can compromise everyone's credentials by replicating secrets from Active Directory via Mimikatz DCSync?


10. If any Active Directory integrated defense-in-depth measures such as these i.e. Smartcard authentication, MFA, Auditing, Random Password Manager, Password Vault etc. are in use, exactly who can disable them to render them useless?

The answer: Active Directory Effective Permissions.  (Not "Who has what permissions in Active Directory.") 

Organizations that do not have exact answers to these 10 simple questions cannot
be considered secure, so let's talk about Active Directory Effective Permissions.

A Simple $ Billion Example

This paramount cyber security concept is best understood via an illustrative example, so let's consider a real-world scenario -

Data Center

A fictional multi-billion dollar organization operates a high-security data-center, in which reside its high-value servers, including most of its file servers, web servers, app servers and Domain Controllers (DCs). Responsibility of managing all servers in the data-center is entrusted to the Data-Center Operations Team, an on-site team of highly trustworthy and proficient IT personnel.

To facilitate the privileged access this team needs, the organization created (and is using) an Active Directory security group called Data-Center Operations Team, and added it (via group policy) to the local Administrators group on all servers and DCs.

In effect, anyone who is a member of this highly privileged Active Directory (domain) security group Data-Center Operations Team has system-wide admin access and can thus control virtually everything in this multi-billion dollar organization's network.

Cognizant of this fact, the organization has worked really hard to minimize the number of individuals in this highly privileged Active Directory security group, and has been able to reduce its memberships to just 6 individuals -

Here are the members of this highly privileged Active Directory security group -

David Parker, IT Manager Erica Lockhart, IT Administrator Larry Ellison, IT Administrator

Michael Karp, IT Security Analyst Pamela Fitzgerald, IT Auditor Patrick Sullivan, Senior Operations Analyst

Speaking of which, for enhanced security, the organization also uses additional security measures to secure and defend all of its privileged user accounts (e.g. Enterprise Admins, Domain Admins etc.) which currently totals 15, including these 6 accounts.


Now, a Billion $ question begs itself - Although this highly privileged and mission-critical domain security group currently only has 6 members, "Exactly how many individuals can change the membership of the Data-Center Operations Team group?!"

This question is paramount because anyone who could change this group's membership could instantly take over everything.


The answer to this simple yet paramount question
lies in Active Directory Effective Permissions...





Active Directory Effective Permissions

First off, as you may know, to find out who can change the membership of the Data-Center Operations Team security group, you have to find out who all actually have sufficient access so as to be able to modify the group's Member property/attribute.

Next, some very quick theory. As you know, literally everything in Active Directory is an object, and each object is protected by an access control list (ACL) that is comprised of zero of more access control entries (ACEs), each one of which Allows or Denies one or more of a dozen types of security permissions to a specific security principal (user, group or well-known SID), and together i.e. collectively (, and not individually) these security permissions impact the resulting access on the object.

With that theory in mind, let's take a quick look at the ACL protecting the Data-Center Operations Team security group, with the intent of finding out who all actually have sufficient access so as to be able to modify the group's Member property -


The ACL protecting the Data-Center Operations Team domain security group in Active Directory



As you can see above, there are numerous ACEs in the object's ACL, each one of which either explicitly or via inheritance, Allows or Denies, one or more of a dozen types of security permissions to various security principals. In fact, observe that -

1. There are numerous Allow and Deny permissions, some of which are explicitly specified on the object, whereas others are inherited down from the object's parent object, and their actual impact is determined by a precedence order.


2. There are numerous types of Active Directory security permissions that are specified, such as Write - Member (Property), Write - Group Membership (Property-Set), Write All Properties, Modify Permissions, Special, Full Control etc.


3. There are numerous security principals for whom these security permissions are specified, including individual users('s accounts), security groups, and well-known security principals (e.g. Domain Users, Authenticated Users, Self, etc.)


4. Of the numerous security groups for which access is specified, they could have other security groups nested in them (, and some could also possibly be circularly nested,) and thus could easily end up impacting access for many users.


5. Of these various access control entries / security permissions that exist in an Active Directory object's ACL, not all of them may actually be applicable to the object, as they may exist solely to facilitate inheritance to downstream objects.

[ Note: For detailed observation, you can download the entire ACL protecting this object here. ]

Considering the above, how do we find out who all have sufficient access to be able to modify the group's Member property?

As observed above, there are numerous security permissions that are specified in various ways (Explicit/Inherited, Allow/Deny) for numerous users and groups (which could in turn contain other groups) in an Active Directory object's ACL, and (theoretically) each one of these permissions could overlap or conflict with each other, thus collectively impacting the actual resulting access.


To see this in action, let us attempt to evaluate the impact that just even two following randomly selected ACEs in this object's ACL can have on the resulting access of a randomly chosen user, Peter Thiel  -

ACE # 13:   Allow    IT America Admin Team             Write All Properties                                                   Inherited 

ACE #  9:    Deny    IT Operations Support Level 3    Write Property - Group Membership Property Set    Inherited

In case it helps, Peter Thiel's (domain user account's) domain security group memberships are displayed below -

As you can see, Peter Thiel happens to indirectly be a member of each of the domain security groups for which permissions are specified in these two ACES, so both these ACEs will end up impacting the actual access that Peter Thiel has on this group.

If you were to consider the first ACE shown above solely by itself, you may errantly conclude that Peter Thiel can modify the membership of this group, because Peter Thiel is a member of the IT Helpdesk Operators group, which is turn is a member of the IT American Admin Team group, which is allowed blanket Write All Properties, and that includes Write Property - Member.

However, if you were to also consider the second ACE shown above, then you will correctly conclude that Peter Thiel cannot in fact modify the membership of this group, because Peter Thiel is also a member of the IT Helpdesk Team group, which in turn is a member of the IT Operations Support Level 3 group, which is denied Write Property - Group Membership Property Set, and it so happens that the Member property is a member (pun unintended) of the Group Membership Property Set.

In essence, it turns out that even though Peter Thiel has Allow Write All Properties specified on the object indirectly, he also has Deny Write Group Membership Property Set specified on the object indirectly, and since the inherited Deny access will override the inherited Allow access, he will effectively have the ability to modify all properties except the Member property on the Data-Center Operations Team security group, and as a result, he will not actually be able to modify the membership of this group.

Now, it must also be mentioned that if there were to be even one other ACE that would explicitly end up allowing Peter Thiel Write-Property - Member whether directly or indirectly, that explicit Allow would override the inherited Deny, in which case, he would in fact be able to modify the group's membership. In such a case, it must further be mentioned that if there were to be even one other ACE that would explicitly end up denying Peter Thiel Write-Property - Member whether directly or indirectly, that explicit Deny would override the explicit Allow, in which case he would not in fact be able to modify the group's membership.

So you see, there could easily be well over a 100 ACEs in the object ACL, and each and every single one of these that specifies either of Write-Property - Member attribute, the Write Group Membership Property Set, Write All Properties or Full Control access, whether it be an Allow or a Deny and whether be explicitly specified or specified via inheritance, will likely directly or indirectly (i.e. via nested group memberships or well-known RIDs and SIDs ) impact whether or not Peter Thiel can change this group's membership, and they will also undoubtedly impact the complete list of users who will actually be able to change this group's membership. In other words, there could easily be over a 100 ACEs in the object's ACL and the permissions they specify collectively impact the resulting access on the object!

Thus, the only way to correctly (i.e. accurately) find out what access the ACEs in an ACL actually end up entitling on the object, and to whom, is to collectively take them into account and determine the resulting i.e. effective access they end up granting.

Consequently, the actual set of permissions / access that a user ends up being granted (i.e. allowed) on an Active Directory object, in light of having correctly considered the collective impact of the entirety of all security permissions specified in all of the ACEs in the object's ACL, are known as the user's effective permissions on that object.

As seen above, it is a user's effective permissions that determine what access a user actually has on an Active Directory object.





Their Importance

Active Directory Effective Permissions are extremely important because as illustrated above, it is "what effective permissions does a user have" and not "what permissions does a user/group have" that determines whether or not a specific user has a specific type of access granted on an Active Directory object.

Consequently, it is Active Directory Effective Permissions that gate every single LDAP operation that can be performed on Active Directory content.

Privileged Access in Active Directory

In other words, they control everything, including who can create, manage and delete all domain user accounts and security groups (including all privileged accounts and security groups), containers, OUs etc. in and across Active Directory.

In fact, in a Microsoft Windows Server based IT infrastructure, from user authentication to secure network-wide authorization to organizational IT assets, not a leaf moves without (access to) Active Directory being involved, and not a single access to Active Directory, whether it be read access or modify access, is possible without users having sufficient effective permissions to do so.

If users did not have sufficient effective permissions in Active Directory, the entire organization would come to a stand still. By the same token, if someone had sufficient effective permissions in Active Directory, he/she could control the entire network!






The Effective Permissions Tab

The importance of Active Directory Effective Permissions is perhaps best conveyed by the fact that in addition to the tabs for Permissions, Auditing and Owner(ship), the fourth tab in Microsoft's native security tooling is for Effective Permissions -

Effective Permissions Tab

In other words, for Microsoft to have dedicated an entire tab for Effective Permissions, they must be at least as important to cyber security (if not more so) as Permissions, Auditing and Owner(ship), which we all know are important for obvious reasons.

Unfortunately, as important as effective permissions are to organizational security today, Microsoft’s Effective Permissions Tab for Active Directory is not only not 100% accurate, it is substantially inadequate (; and has been so for a decade now.)

Here's why -

1. It is not always 100% accurate, since it self-admittedly does not take all relevant factors into account


2. Most importantly, it can only determine (an approximation of) effective permissions (granted to) ONE user at a time


3. It cannot show which underlying permissions in the object’s ACL entitle a specific user to a specific effective permission

As to its accuracy, as shown in the snapshot above, in reference to the example considered in the previous sections above, for the user Peter Thiel, it is indicating that Peter Thiel has Write all properties effectively allowed. This is inaccurate because as illustrated in the example above, in reality, Peter Thiel has the ability to write (to) all properties except the Member property, and this fact is evidenced by the following snapshot -

Insufficient Access

As seen above, the Add and Remove Member buttons are disabled (grayed out) for Peter Thiel because he does not in fact have sufficient effective permissions to modify the Member property on the Data-Center Operations Team security group.

As to its limitation of only being able to determine an approximation of effective permissions for one user at a time, this single limitation renders this tab virtually useless, because due to this limitation, the only way for an organization to determine exactly who all have a specific type of effective permission on a specific Active Directory object, would be to have IT personnel manually enter the identities of every single one of thousands of domain accounts one by one, and make a note of each user's effective permissions, and that is neither practical nor realistically feasible.

As to its inability to be able to identify and pinpoint the underlying security permissions in the object's ACL that are entitling a specific effective permissions for a specific user, this ability is essential if organizations are to have any hope of being able to lockdown any excessive effective permissions/access that may have been identified on a specific Active Directory object. After all, if you don't know which ACE / security permission / security group membership you need to tweak to eliminate or lockdown an excessive effective permission, how are you going to mitigate the identified risk?

In short, in reality, the substantial deficiencies inherent in Microsoft's Effective Permissions Tab make it virtually unusable. The same is true of most other tools from Microsoft that claim to do effective permissions, including dsacls, acldiag, accesschk etc.

Further, whilst numerous vendors claim to offer solutions that can help find out "who can do what in Active Directory" or "who has what effective permissions", not a single one of them actually determines effective permissions, let alone being able to determine them accurately. They merely perform basic permissions analysis. Finally, this one tool that claims to be able to do effective permissions is not only dangerously inaccurate, it has the same deficiencies as Microsoft's Effective Permissions Tab.





A Huge Challenge

(This section is for all amateurs who might say - "What's the big deal here? I imagine I could this with some PowerShell?")

As we saw above, merely evaluating the collective impact of just 2 ACEs alone can be complicated. In many real-world Active Directory deployments, there may be over a 100 ACEs in the ACL of each Active Directory object, and correctly collectively considering the entirety of all security permissions specified in each of these ACEs can be extremely difficult.

In fact, the accurate determination of effective permissions in Active Directory poses a HUGE challenge for the world.

Here's why -

1. Active Directory's security model, albeit extremely powerful, is substantially more complex than the traditional Windows file and folder security model. For instance, while there are only a few generic permissions in the file and folder security model, there are almost a dozen generic permissions in Active Directory's security model, and in addition there are also almost five dozen special permissions known as Extended Rights, all of which substantially increases its complexity.


2. The problem size is substantially larger, in that there are far more ACEs in an Active Directory object's ACL than there are in a file or a folder's ACL. In many Active Directory deployments, there may easily be over a 100 ACEs in each Active Directory ACL, considering that a substantial amount of access provisioning is done in Active Directory to facilitate administrative delegation and to configure access for various Active Directory integrated applications and services.


3. The existence of and thus the need enumerate of a possibly large number of domain security group memberships, especially those that may be deeply nested as well as those that may be circularly nested, further increases the complexity of the process of performing accurate access evaluation and conflict resolution.


4. The inclusion of numerous arcane details that are unique to Active Directory, such as including the impact of object ownership on effective access, dynamically evaluating relative well-known RIDs etc. further complicates the process.

Consider this - Imagine trying to determine effective permissions on an Active Directory organizational unit, in whose ACL there exist 150 ACEs, 100 of which specify varying levels of access for security groups, 75 of which (i.e. security groups) contain nested security groups, 50 of which contain deeply nested security groups, and 25 of which deny various forms of access and 10 of which are circularly nested, and you'll get a sense of just how difficult this process can be to perform, let alone automate.

What Organizations Need

In light of the fact that Active Directory Effective Permissions are vital and in fact paramount for organizational cyber security, today, organizations absolutely need the ability to be able to accurately and efficiently determine effective permissions in their Active Directory deployments.

After all, considering that the foundational Active Directory deployments of most organizations have been in operation for years now, in most deployments today there very likely exists rampant unauthorized / excessive effective permissions / access, so organizations need to identify and lockdown all such unauthorized / excessive effective permissions / access, especially that granted on mission-critical content, such as all high-value (privileged and executive) user accounts and security groups, the Domain Controllers OU, the domain root, AdminSDHolder, various parts of the Configuration and Schema partition etc.

Here are 3 simple needs that organizations have regarding determination of Active Directory effective permissions -

1. Accuracy - First and foremost, the ability to be able to accurately determine effective permissions in Active Directory


2. Efficiency - Secondly, the ability to be able to efficiently determine effective permissions in Active Directory i.e. ideally be able to determine the complete set of effective permissions granted on an object, as well as the identities of all users who have these effective permissions granted, without having to enter each user's identity one at a time.


3. Source-Identification - Finally, the ability to be able to identify which underlying security permissions in the object's ACL are entitling a specific user to a specific effective permission on a specific Active Directory object.  

If these 3 simple needs could be fulfilled, organizations could swiftly attain and maintain least privileged access (LPA) in and across their foundational Active Directory deployments.

The Solution - An Adequate Active Directory Effective Permissions Calculator

Given just how important it is for all organizations to be able to adequately determine effective permissions in Active Directory, it was clear to me about a decade ago that if the world didn't have an adequate solution for this, in years to come we would all be facing a major cyber security challenge.

So, about a decade ago we decided to take on this huge challenge and started working to build an adequate solution to address it, because we had understood back then just how important and essential this was going to be for the world, in years to come.

(The intention was never to build a cyber security company per se, but rather a desire to take this huge challenge head-on, and to see if we could solve it, and further to see how well we could solve it i.e. just how easy could we make it for everyone. The company and its products are merely an outcome of the successful pursuit of this desire to address this challenge for the world.)

Today, it is my privilege to share with you the outcome of over half a decade of innovative, industrious and committed research and development, so allow me to share with you Gold Finger for Active Directory, the world's only accurate Active Directory Effective Permissions Calculator / Tool that also delivers on everything organizations need to address this huge challenge -

Gold Finger Active Directory Effective Permissions Tool / Audit Tool / Calculator

At the touch of a single button, Gold Finger can -

1. First and foremost, accurately determine effective permissions on Active Directory objects


2. Secondly, it can determine the complete set of effective permissions granted on an object, as well as the identities of all users who have these effective permissions granted, without having to enter each user's identity one at a time.


3. Finally, it can also identify which underlying security permissions in the object's ACL are entitling a specific user to a specific effective permission on a specific Active Directory object, thus helping making remediation very simple. 

I suppose the only thing more remarkable that Gold Finger's abilities is its simplicity of use. All you need to do it launch Gold Finger, point it to an object in Active Directory, and click a button.

When you click that button, under the hood and completely transparent to you, over half a million lines of code go to work, and within minutes, if not seconds, determine the complete set of effective permissions entitled on an Active Directory object, the complete set of individuals to whom each of these effective permissions are entitled, and the underlying security permissions in the object's ACL that entitle every identified user to every entitled effective permission on the object.

On a humorous note, the only downside of its remarkable simplicity is that it makes the solving of such a difficult technical challenge look so simple that people often wonder what the big deal is! I mean you just click a button, and you're done ;-)


In order to appreciate just how difficult and complex this problem is to solve, perhaps its worth taking a look under the hood...

Under the hood, when you click that button, Gold Finger begins by locating Domain Controllers, identifying the object, retrieving its access control list, and then it initiates the computation of accurate effective permissions analysis on the object, which involves so many technical functions such as but not limited to discovering and analyzing the Schema, resolving SIDs, correctly expanding all relevant security group memberships many of which could be deeply nested, identifying and resolving circularly nested security group memberships, analyzing individual permissions in each ACE (of which there could technically be over a 100 in an ACL), evaluating the impact of each one of them in light of numerous factors such as and not limited to precedence orders, applicability, suitability, inclusion in property sets etc. as well dynamically evaluating any and all well-known RIDs (e.g. Domain Users) and SIDs (e.g. Everyone), mapping Self SIDs to the security principal if applicable, etc. and a whole lot more, and ultimately arriving at its output, and presenting it in a fashion that is as intuitive and user-friendly as it could possibly be.

In contrast, all that most of the currently available Active Directory Permissions Analysis/Audit solutions in the world do today is merely retrieve an Active Directory object's ACL, and report the identities of the security principals encountered in the ACL along with the security permissions specified for that security principal in the ACL. (Some of them may expand a few security group memberships.) In effect, they do about 1% of what needs to be done to do this correctly (because they don't know better), yet they have thousands of customers who too don't know better, and happily proceed to act on dangerously inaccurate data.


Now, consider this - Active Directory environments can be so diverse in nature (from a small 100 object single Active Directory domain/forest for a small business to a globally dispersed Active Directory forest with possibly dozens of domains and 100s of 1000s of objects) that it is extremely difficult to build a product / solution that can automate this process such that it can just work in any Active Directory environment!

One of our many customers worldwide, a prominent 3-letter acronym government agency has 250+ ACEs in the ACL of every object in their Active Directory, and Gold Finger accurately determines effective permissions on these objects within minutes.

There is only one other thing I'd like to mention - while this tool can automatically determine effective permissions and effective access on individual Active Directory objects, its big brother, the Privileged Access and Delegation Audit Tool (i.e. this one) can accomplish the monumental feat of automatically being able to do so on 1000s of objects i.e. an entire Active Directory domain!

Thus, as you can see not only is this paramount to global cyber security today, it is by no means an easy problem to solve, let alone automate. In fact it is almost impossible, and at Paramount Defenses, we go to great lengths to make what is considered impossible as easy as touching a button.

The Answer

This post would not be complete without providing the answer to the paramount cyber security question posed above, which was - "Exactly how many individuals can change the membership of the Data-Center Operations Team group?!"

The Answer: 27.

So, while this vital security group only has 6 members, today there are 27 individuals who can change/control its membership.

In fact, here is the complete set of effective permissions entitled on the Data-Center Operations Team security group.

Now, in case you're wondering how I figured it out, it was actually rather simple; I just clicked one button -

Gold Finger Active Directory Effective Permissions Tool / Audit Tool / Calculator

Specifically, I launched Gold Finger, pointed it to the Data-Center Operations Team domain security group in Active Directory, and clicked the Run button. That's it. A few moments later, as shown above, I had the results. (Here is the exported output.)

So, as you can see, without the ability to determine effective permissions in Active Directory, and of course, do so accurately, we would never know just how many individuals can control the membership of such a vital security group, and who they are.

Without this valuable insight, the organization would have continued to indefinitely operate under the false assumption that only 6 people could control the entirety of their high-business impact (HBI) servers in their highly secure data-center, whereas in fact in reality there are 27 individuals who can do so today!

(Oh, and we haven't yet evaluated and included the number and identities of individuals who have effective modify permissions on this group, and the number and identities of individuals who can reset the passwords of those 27 individuals and who have effective modify permissions on each one of those 27 accounts. Yet at the very least, we've been able to answer the question.)

That is what we mean when we say that most organizations today are operating in the dark. There are many many more individuals that possess all kinds of privileged access in Active Directory than those that they think they know about.





A Note About Microsoft

Folks, as former Microsoft Program Manager for Active Directory Security, I care deeply about Microsoft as well as the foundational cyber security of all organizations worldwide, so I wanted to share a few thoughts.

By now, you've hopefully comprehended just how important Active Directory Effective Permissions are to organizational cyber security. They are absolutely paramount to Active Directory Security, and Active Directory Security is absolutely paramount to the organizational security of thousands of organizations, and to the security of Microsoft's ecosystem.

If this is the case (and this is the case,) how could Microsoft have completely forgotten to educate its global customer base about such an important and mission-critical aspect of cyber security for an entire decade?! It is absolutely astounding!

Last year, when they finally provided some earnest guidance on the importance of defending Active Directory, while they spoke at length about security permissions in Active Directory, they again completely forgot to tell the world about the fact that to attain and maintain least privileged access in Active Directory, you need to determine effective permissions in Active Directory!

It is in light of the above that I asked this question - How Well Does Microsoft Really Understand Cyber Security?

I find it partly amusing and partly concerning that on one hand Microsoft may not even have educated its customers about such a vital aspect of cyber security for an entire decade (most likely because this paramount aspect of cyber security wasn't even on their radar), yet on the other hand, it is wooing and wants the world to entrust their cyber security in its recent Cloud offering!


One cannot emphasize enough just how paramount Active Directory Effective Permissions are to global security today. In most organizations worldwide, due to almost complete ignorance about the value and importance of effective permissions, we have a situation wherein most organizations are operating in the proverbial dark, and there in all likelihood exist thousands of excessive / unauthorized effective access grants, which pave thousands of privilege escalation paths in Active Directory, which can today be easily identified and exploited by any insider / intruder who knows how to determine effective permissions in Active Directory, even if with marginal accuracy.

Fortunately, since organizations worldwide can now accurately and efficiently determine Active Directory effective permissions, they can now finally secure and defend the very foundation of their security, their foundational Active Directory deployments.





A Note About the Black Hat Conference 2017

Folks, as some of you may know, the famed Black Hat Conference is on in Las Vegas, Nevada, USA.

Black Hat Conference

The Black Hat Conference is supposedly one of the top cyber security conferences in the world, and given how vital cyber security is today, thousands will be attending, and numerous cyber security experts will be presenting at Black Hat this year.

YET, not a single one of these top cyber security experts knows much about Active Directory Effective Permissions, or how to calculate them, or their paramount importance to Active Directory Security and thus to organizational security, or has a solution.

NOT one of them!

This, when in fact Active Directory Security is at the very foundation of cyber security of almost all organizations worldwide whose employees (from IT Security Analysts to CISOs) will be attending the Black Hat Conference in Las Vegas this year!


( Last year I learnt just how much (or should I say how little) the Black Hat Conference Review Board seems to know about Active Directory Security, when I had a chance to communicate with them about a presentation I wanted to do on Active Directory Security last year to help raise awareness, which they declined. They allowed a presentation titled "Active Directory Beyond the MCSE" by a respected MCM, but they declined a presentation titled "From Zero to Enterprise Admin Within Minutes" by former Microsoft Program Manager for Active Directory Security. In light of this, I will let you be the judge of how much they seem to know. The loss was solely theirs, and I will NOT be applying to present at the Black Hat Conference again.

In retrospect, I can't blame them, because as I have said and proven, over the years, Microsoft has provided ZERO guidance on this to the world, so how're Black Hat's experts supposed to know about this paramount aspect of cyber security? So hey Black Hat Conference Review Board, here's Active Directory Security 101 to get you guys ramped up - Active Directory Security. )


By the way, this year there will be a presentation titled "An ACE Up the Sleeve: Designing Active Directory ACL Backdoors."

Here's its description -

"Active Directory (AD) object discretionary access control lists (DACLs) are an untapped offensive landscape, often overlooked by attackers and defenders alike. The control relationships between AD objects align perfectly with the "attackers think in graphs" philosophy and expose an entire class of previously unseen control edges, dramatically expanding the number of paths to complete domain compromise.

While DACL misconfigurations can provide numerous paths that facilitate elevation of domain rights, they also present a unique chance to covertly deploy Active Directory persistence. It's often difficult to determine whether a specific AD DACL misconfiguration was set intentionally or implemented by accident. This makes Active Directory DACL backdoors an excellent persistence opportunity: minimal forensic footprint, and maximum plausible deniability.

This talk will cover Active Directory DACLs in depth, our "misconfiguration taxonomy," and enumeration/analysis with BloodHound's newly released feature set. We will cover the abuse of AD DACL misconfigurations for the purpose of domain rights elevation, including common misconfigurations encountered in the wild. We will then cover methods to design AD DACL backdoors, including ways to evade current detections, and will conclude with defensive mitigation/detection techniques for everything described."

Finally a talk at the Black Hat Conference focused on weaknesses in Active Directory DACLs !  Kudos, but/and I just have one question - What took you guys so long?!  I mean, are these "experts" just now realizing all this in 2017  i.e. 17 years after Active Directory was shipped!  We have been saying this for years now, and 've already solved this problem over half a decade ago !

The respectable "experts" giving this presentation on Active Directory Security are absolutely right that "Active Directory ACLs are an untapped offensive landscape, often overlooked by attackers and defenders alike, and that while ACL misconfigurations can provide numerous paths that facilitate elevation of domain rights, they also present a unique chance to covertly deploy Active Directory persistence." That said, what these respected experts (may or) may not yet know is that at the root, crux and heart of all this actually lie Active Directory Effective Permissions.

So, to help these experts, newbies, and the entire world, in a few days, on this blog, I'll share just how easily organizations can now find and eliminate each one of these backdoors, leaving NO room to hide, or as they persist. Interestingly, the solution to that too involves (surprise!) Active Directory Effective Permissions.  Speaking of which, I doubt there will be any mention of Active Directory Effective Permissions in the ACE Up the Sleeve presentation, again thanks to 0 guidance from Microsoft!

As for that BloodHound tool, although it has gained much popularity especially amongst pen testers, it is massively inaccurate because it makes the same classic mistake that people have been making for years now i.e. it tries to find out "who has what permissions in Active Directory" when in fact what it should be trying to do is find out "who has what effective permissions in Active Directory."  The fact that it can still find so many holes only shows and proves just how bad the situation is out there!

Technically, comparing Gold Finger to Bloodhound is like comparing a Lamborghini to a prototype of the world's 1st car.

The one other very important thing to note is that while Bloodhound primarily aids attackers in attacking Active Directory, Gold Finger primarily aids organizational IT personnel in defending Active Directory, and in fact today Gold Finger may be the only solution that can help organizations identify and eliminate any backdoors or paths that attackers could find using Bloodhound.


Alright, enough of this. Actually, the Black Hat Conference doesn't deserve much mention here, but since the one presentation on Active Directory is completely focused on Active Directory ACLs, and since so many organizations are tuned-in to Black Hat this week, I figured they ought to know about a matter of paramount importance to the very foundation of their cyber security.

While I'm at it, let me tell you that not a single one of the world's top cyber security companies, including Microsoft, Cisco, IBM, Google, Amazon, EMC, Dell, HP, CA, Centrify, Palo Alto Networks, Blue Coat, FireEye, CyberArk, Beyond Trust, Leiberman Software, Thycotic, Checkpoint Software, Palantir Technologies, Kasperky Labs, Tripwire, DarkTrace, Lockheed Martin, BAE Systems, Tanium, BAH, etc. etc., likely has a clue about this or a solution to help organizations determine Active Directory Effective Permissions (, when in fact likely at their very foundation too lies Active Directory.)  Not a single one of them!





In Summary

I've been sharing my thoughts and perspectives for years now, on the Cyber Security Blog, the Active Directory Security Blog, and recently on the Paramount Defenses Blog. Of all the posts I've penned thus far (, and I've penned well over a 100 by now), this is possibly the most important one yet.

It is so because what I shared today directly impacts the foundational cyber security of thousands of government and business organizations in the world, and AFAIK, nothing is more important than securing and defending the very foundation of security.

It is Paramount (; and thus the name, Paramount Defenses.)


Make no mistake about one fact - no Active Directory deployment can be secured without possessing the ability to determine effective permissions / effective access in Active Directory, and no organization (not matter how big or powerful it may be) whose foundational Active Directory is not secure, can be considered secure from a cyber perspective.

That's all for today, Day 10 of this.

Best wishes,
Sanjay


PS: If you liked this blog post, you may like reading (each one of) these + stuff here, thinking about this, and checking this out. If you only have time to read one of them, I would read this one or this - A Trillion $ Active Directory Privilege Escalation Example.

A Most Important Microsoft Video on Defending Active Directory (Day-9)

Dear Microsoft,

Today is Day-9 of our Active Directory security school for Microsoft. I was finally going to talk about effective permissions today, but I figured I should first share an incredibly important video on AD Security from Microsoft, since it bridges the gap so well between Day-8 ("An Ocean of Access Privileges In Active Directory") and Day-10 ("Active Directory Effective Permissions".)



Defending Active Directory

Here's that incredibly important video from Microsoft (and you can watch it right here, or online at Microsoft's website here) -

(Please click the Start Lesson button to view the video. If it does not play, you can see it on Microsoft's website here.)

The summary of this video titled Defending the Directory is - "Do you know who your admins are? Learn why maintaining solid access control to sensitive directory objects is important for mitigating stealthy means of persistence & escalation of privilege."

By the way, I highly recommend all IT Professionals involved with Active Directory Security to see this entire video at least once.





12 Very Important Points Made in this Video from Microsoft -

Today, I just wanted to highlight 12 incredibly important points made in this video, and I've quoted them directly from the video -

1. "The first thing I want to discuss is admins that are a little bit less obvious, or you don't realize they're admins" 


2. "Lots of customers I work with are laser focused on Domain Admins, Enterprise Admins, Builtin Admins and Schema Admins, and they think that if I know who is a member in any one of those groups, I know who my admins are, which isn't always necessarily the case, because with the way that Active Directory works, you can delegate access to different objects through access control lists"


3. "If I had permissions to say link a GPO to the Domain Controllers OU, then I could use that to go from what appears to be an unprivileged account to having full control over Active Directory"


4.  "I am able to do this (i.e. use Mimikatz DCSync to replicate everyone's hashes from Active Directory) using a plain domain user account because this account has been delegated some rights at the Domain level"


5. "A lot of organizations have been using Active Directory since it was released back in 2000, and then they went to 2003 and then 2008 and now they're on 2012, and over that time period they've probably had a lot of turnover in the organization, so the guy that setup AD 10 years ago isn't with the company anymore, and the guy that's doing this now is inheriting a mess potentially from several previous administrators, and people could have delegated this for what they thought was a legitimate reason, and it leaves another attack vector that is less obvious."


6. "Absolutely everything inside of Active Directory is an object, protected by ACLs and these things (ACLs) can be manipulated in a great number of ways depending on what permissions you have there"


7. "You can be an admin through (deeply) nested groups. I have seen that quite a bit. It can get pretty messy."


8. "Contest your delegates. Challenge them. Go and find out who has been delegated what privileges"


9. "If I have write member permissions on a group, I can add myself to this group, and since this group via group nesting is a member of the Domain Admins group, I could easily and instantly escalate my privilege to that of a Domain Admin"


10. "So effectively that is a means of escalation!"


11. "If a group or account has been granted change reset password on an account, and that account is privileged, I can change the password on that account, and now I own it!"


12. "We're getting pretty deep into the inner workings of Active Directory, but based on what you showed us in the demo, its super important. It is, it is VERY IMPORTANT because these are all different ways that I could use to escalate privilege, and they're not obvious because its controlled by the access control lists (ACLs)! "

Microsoft, great advice! Each one of them is worth is proverbial weight in Gold, and is exactly what we've been saying for years.

Now, that said...




Just 1 Question

Dear Microsoft, I just have one question for you, and I have asked this before as well, but nonetheless I will ask it again.

Possibly the most important message in this video is, and I quote - "Go and find out who has been delegated what privileges" because "everything in Active Directory is an object" "protected by access control lists" and "this is very, very important"

BUT, you completely forget to tell them the most important part, which is - "how to correctly assess who has actually been delegated what privileges in Active Directory i.e. who actually has what effective / resulting access in Active Directory?!"

So the simple question is -

Exactly what do organizations worldwide need to do to correctly find out who has been delegated what privileges in Active Directory? i.e. What is the ONE technical aspect that governs the accurate determination of who can actually do what in Active Directory that they need to know about to make this paramount determination?

HINT: The presenter completely missed it even though it was right in front of his eyes (from 0:21:50 - 0:22:05)

The simple answer, also the topic of our next post (Day-10), is - "Active Directory Effective Permissions / Effective Access." 

Best wishes,
Sanjay


PS: By the way, see how "everything in AD is an object protected by ACLs" ties into Day-8, An Ocean of Access Privileges.

PS 2: Is it just us, or do you too find it so co-incidental that in May 2016, i.e. within 2 months of this, and for the first time in the 16 years that Active Directory has been around, Microsoft develops and releases a 7-part series of 12 videos titled "Defending Active Directory against Cyberattacks". The entire series can be found here. They even made a promo for it.

An Ocean of Access Privileges in Active Directory Deployments (Day 8)

Folks,

Today is Day-8 of our Active Directory security school for Microsoft. I was going to talk about effective permissions today, but perhaps I should shed light on the ocean of access privileges that lies within Active Directory deployments worldwide today.


An Ocean of Access Privileges within Active Directory Deployments Worldwide

In virtually every Active Directory deployment in the world today, irrespective of its size (small or big), the entirety of its content i.e. the thousands of objects that reside within each Active Directory deployment, is protected by an ocean of access privileges.

Specifically, each object in Active Directory is protected by a unique Windows security descriptor, which contains amongst other components, an access control list (ACL) which is comprised of numerous access control entries (ACEs), each one of which serves to Allow or Deny a specific type of access (of which there are a dozen types) for a specific security principal, and together i.e. collectively (, and not individually) it is this entire set of security permissions specified in an Active Directory object's ACL that determine the actual (i.e. resulting/effective) access that is authorized on each one of these Active Directory objects.


For instance here is the ACL protecting the domain user account of the CEO of a fictional multi-billion dollar organization -

The ACL on the CEO's Domain User Account  

(To view the ACL (generated via this tool) click here.)

As you can see, there are numerous security permissions that specify various types of access, some of which Allow access and some of which Deny access, and of these, some are explicitly specified while others are inherited from parent objects, and while some specify access for individual users, others specify access for security groups and well-known security principals. Further while most of these might actually be applicable on the object some may exist only to be inherited downstream to child objects.

In a typical Active Directory domain, in these ACLs, access privileges, of which there are a dozen generic Active Directory security permissions and over five dozen special security permissions (extended rights), are specified for 100s if not 1000s of unique domain security groups, domain user accounts, domain computer accounts and various well-known security principals.

Further, in many Active Directory deployments worldwide, there are easily over 100 security permissions (ACEs) specified in the ACL of each Active Directory object, and there are easily 10s of 1000s of objects in Active Directory, and consequently today there likely exist millions of security permissions in most Active Directory deployments.

Here's what 0.001% of this ocean of security permissions in an Active Directory domain actually looks like - here.

(At one of our customers, one of their Active Directory domains had 100,000+ objects and 250+ ACEs in each object's ACL.)

In other words, as you can see, in each Active Directory deployment there is an ocean of access privileges today, and it is this ocean of access privileges that together controls and governs who ultimately has what access on everything in Active Directory, including who ultimately has privileged access (the Keys to the Kingdom), in these foundational Active Directory deployments.




In this Ocean Lie the Answers

In order to be able to answer even one (1) of the following paramount cyber security questions, organizations must be able to accurately determine "who has what effective permissions" in this ocean of access privileges that lies in their Active Directory -

1. Exactly how many privileged users are there in an organization’s Active Directory?
2. Exactly how many privileged security groups are there in an organization’s Active Directory?
3. Exactly who can reset the password of a privileged user to elevate privilege in an organization’s Active Directory?
4. Exactly who can modify the group membership of a privileged security group to elevate privilege in Active Directory?
5. Exactly who can create, delete and manage user accounts, computer accounts, groups, OUs etc. in Active Directory?
6. Exactly who can compromise the credentials of all accounts by using Mimikatz DCSync ?
7. Exactly who manage the domain user accounts of the organization’s executives (Chairman, CEO, CFO, CIO, VPs etc.)?
8. If Smartcard authentication or similar measures (i.e. band-aids) are in use, exactly who can instantly disable them?

The operative and paramount word here is "effective permissions" i.e. to be able to answer these questions, one must be able to accurately determine "who has what effective permissions" not "who has what permissions" in and across Active Directory.

More on that in days to come.

Best wishes,
Sanjay


PS: I'm going to try and keep these posts short and to the point from now on.

Lack of Gravitas at Organizations + Risks of Amateur Tooling (Day 7)

Folks,

If you review what I've shared thus far on Active Directory Security, you may likely see why I believe that Microsoft may have completely missed out, for over a decade, on educating the world about what clearly is such a vital aspect of cyber security.

However, in Microsoft's slight defense, I'd also like to add that organizations and amateur vendors are partly responsible too.



In Ever So Slight Defense of Microsoft

First and foremost, I would like everyone to know that I love and care deeply for Microsoft, (and have many friends at Microsoft,) which is the only reason that I am spending so much effort on helping Microsoft and the world understand all this important stuff.

As I indicated on Day-0, the sole objective of conducting this school for Microsoft is because they completely missed out on educating their customers about the importance of "Effective Permissions" to Active Directory security for an entire decade.

In support, I provided irrefutable proof: Top-3 official/primary sources of guidance from Microsoft on Active Directory security -

1. Microsoft's original 100+ page official Best Practice Guide for Securing Active Directory (Part I) and Part II

2. Microsoft's latest official Best Practices for Securing Active Directory guidance, introduced by Microsoft's CISO

3. Microsoft's latest 5+ hour series of 12+ videos on Defending Active Directory Against Cyber Attacks

As of Jan 26, 2017 (and likely even today), if you did even a simple keyword search for the term "effective permissions" across these 3 official authoritative sources of guidance from Microsoft, you'll find 0 instances of the term "effective permissions."

Zero!      нуль, nul, صفر , 零,Null, μηδέν, ʻole, אֶפֶס , शून्य, ゼロ,제로, nihil, sero !

In all likelihood, if you were to additionally review 10+ years worth of Microsoft TechEd presentations, i.e. a 1000+ of them, presented by Microsoft and other industry experts, again you may likely find virtually zero mention of "effective permissions."

In light of these facts, as hard as I try, it is very difficult for me to defend Microsoft's complete ignorance on the subject.


That said, if I had to try, I would probably have said the following -

If I were still at Microsoft, in its defense I would probably have said - "generally speaking, at Microsoft our primary charter is to make BIG, lasting changes, such as embracing the Cloud, and of course helping safeguard our customers from serious risks to their security (e.g. combating credential-theft attacks.) It does appear though that, for whatever reason, one such serious risk (illustrated here) may not have been on our radar all this while, and we will begin by looking into how and why we may have systemically and completely forgotten to educate our customers about it, for an entire decade.

(Most of my friends at Microsoft would agree that at the very least Microsoft should have adequately educated its customers.)

After all, for Microsoft to have completely missed providing any guidance on such a vital security topic for more than a decade, more than a few folks would've had to have missed this / not gotten it (at all) - several folks on the Product Development Team, Security Business Unit, Microsoft Research, Trustworthy Computing Group, MCS, PSS, MS IT and others, but we'll let it go and focus on helping them get it.

Moving on to...




Lack of Gravitas at Organizations

Microsoft may not be entirely responsible for a global lack of understanding on such a fundamental aspect of cyber security.

Over the last decade, at Paramount Defenses, we've had an opportunity to learn a lot about several thousand organizations, all of whom knocked at our doors unsolicited, and if there is one commonality we've found, it is that most organizations seem to lack gravitas and the depth of knowledge required to adequately protect their foundational Active Directory deployments.

IT Personnel at Organizations

We could share stories many almost unbelievable stories with you, and we're talking about so many of the biggest organizations in the world, but we will never do that because we're professionals. I will just leave it at saying that at the end of the day, based on what we have seen thus far, there are 3 aspects that organizations seem to lack (to varying degrees) -

1. First and foremost, the understanding that if their Active Directory is compromised, the very foundation of their cyber security is compromised and thus that the very fabric of trust across their network would have been pierced.


2. Secondly and as a consequence, (the fact that) adequate protection of foundational Active Directory deployments may not even be on their radar, let alone it being one of the top (and adequately funded) cyber security priorities today.


3. Lastly, at many organizations, IT groups/departments seem to lack the depth of knowledge as well as the expertise required to adequately protect their foundational Active Directory deployments.

Given that Microsoft's documentation at least unequivocally states the value and importance of adequately protecting Active Directory, in light of the above 3 points, it appears that perhaps organizations may likely also be partly responsible -

Quoting Bret Arsenault, Microsoft’s CISO from the Foreward of Microsoft's official whitepaper on Active Directory Security – “Active Directory plays a critical role in the IT infrastructure, and ensures the harmony and security of different network resources in a global, interconnected environment.”

How much clearer could Microsoft have been than the CISO of Microsoft Corporation stating the above?

Sadly, the reality on the ground today is that so many organizations worldwide do not yet seem to be taking the security of their foundational Active Directory deployments as seriously as they should, and thus may not even know what the attack surface is, what the top Active Directory security risks are, what the easiest avenues to compromise may be, how colossal the impact of an Active Directory security breach could be, what risk mitigation measures they should be enacting to protect Active Directory etc.

Here's super simple evidence - Each week we get to speak to Domain Admin equivalent IT personnel from many organizations across the world, and in many cases, they just do not seem to know what effective permissions in Active Directory are.

I must ask this with complete respect - "Realistically speaking, if Domain Admins at such prominent business and government organizations do not even seem to what effective permissions are, how can these organizations protect their foundational Active Directory deployments?" (No, we're not talking about Mom and Pop Stores, we are talking about multi-billion $ organizations.)





Lastly, Risks of Amateur Tooling (From Amateur Vendors)

The one other thing I will add is that the presence of amateur vendors in the Active Directory security space worries us, because they may be worsening the situation. I say that because not only may their solutions actually be exposing organizations to far greater security risks, their misleading marketing may be giving customers a false sense of security, and that's dangerous.

Sales Associate at Amateur Vendor

Allow me to explain. We know of several vendors in the Active Directory Security space that offer very basic Active Directory reporting/management solutions. If you look into whose behind them, you'll find that many of them are built by puny companies in developing countries by mostly amateur developers, which makes you wonder how reliable and secure their solutions might be. Some of them are outright inaccurate and many of them are not even digitally signed, and they are being sold to and being used by Domain Admin equivalent IT personnel at multi-billion dollar business and government organizations across the world.

Further, more concerning is that fact that many of them are required to be run either as System on Domain Controllers or in highly elevated security contexts such as Domain Admin! Specifically, many of them require organizations to add the service account being used by that solution to the membership of the Domain Admins group.

Code

That, in our professional opinion, is a serious risk, because in essence you have potentially untrustworthy code that isn't even digitally signed, written by amateur developers, with its codebase residing who knows where, running as System on DCs or as Domain Admin at thousands of prominent business and government organizations in the United States, Europe and far beyond!

Think about it. If a nefarious entity or an APT were to be able to compromise even one of these vendors and acquire the ability to tamper with their code-base, it could very quickly completely compromise hundreds, if not thousands of organizations!

This also raises the question as to who at these organizations is authorizing the deployment of a solution to be run as System on DCs or as an Domain/Enterprise Admin, when it is not even digitally signed, i.e. that's trustworthiness evaluation 101.


Finally, there is the part about misleading marketing giving customers a false sense of security, elaborated below.

There are several vendors that offer very basic Active Directory Permissions Audit solutions (i.e. basically well-presented Active Directory ACL dumps) that are substantially inadequate if what you're trying to do is audit privileged access in Active Directory.

Yet, their marketing verbiage (both on-site and in advertisements displayed on Google, Bing etc.) misleads organizations into believing that their products are sufficiently capable of getting the job done, and because these customers don't know better (because Microsoft has never talked about Effective Permissions), they end up acquiring these solution to perform basic Active Directory permissions audits, which obviously provide them with a substantially misleading picture, as a result of which they end up making highly sensitive access-control decisions based on inaccurate data, and in doing so, from that point on, they end up operating on a false sense of security.

Should you like to see what I'm talking about for yourself, simply click here, or Google Active Directory Permissions Audit.

In contrast, technically speaking there is only one correct way to audit privileged access in Active Directory - this.

In fact, one of these solutions is so inaccurate that (to paint you a picture) if it were a security scanner being used at an airport, let alone boarding the flight, we would get out of the airport immediately. The shocking part is that not only does its vendor not know that its not accurate, they've actually spent some marketing dollars to get coverage in a few publications, and of course the publications ran with it, so now you have a vendor that has an inaccurate solution that is also vouched for by small-time publications, and how many IT personnel do you think actually have the expertise to evaluate its accuracy? They'll just see the endorsement from a publication, give it a second's thought, and run with it, and in doing so will have jeopardized their security.

In short, the availability of misleading and potentially low-assurance solutions from many puny vendors does not help security.




Wrapping It Up

Alright, I've said enough today. The point is that Microsoft alone may not be entirely to call out for the fact that 99% of the world has no clue that there's likely a security hole the size of the Pacific Ocean in their foundational Active Directory deployments.

Organizations too likely bear some responsibility for being deep in the dark, especially given that so many of them have been operating on Active Directory for years. Lastly, vendors with misleading marketing and products don't help the situation either.

Next post onwards, we'll get objective and technical and dive into some serious Active Directory security internals.

Best,
Sanjay


PS: The objective of this is to help Microsoft get the importance of effective permissions/access to Active Directory security, so that they in turn can help their global customer base understand the sheer vitality of this essential cyber security capability.