[{"data":1,"prerenderedAt":920},["ShallowReactive",2],{"post-adfs-installation":3,"post-list":643},{"id":4,"title":5,"alsoIn":6,"body":7,"category":627,"date":628,"description":629,"draft":630,"extension":631,"image":632,"links":6,"meta":633,"navigation":634,"order":6,"path":635,"readingTime":636,"seo":637,"series":6,"stem":638,"strength":639,"tags":640,"unlisted":630,"updated":6,"__hash__":642},"posts\u002Fposts\u002Fadfs-installation.md","ADFS Installation",null,{"type":8,"value":9,"toc":614},"minimark",[10,15,19,23,26,39,41,45,48,55,58,63,66,71,74,79,82,87,90,95,98,103,106,111,114,119,122,127,130,135,138,143,146,151,154,159,162,167,170,175,178,183,186,191,194,220,225,228,231,236,239,244,247,264,267,307,310,315,318,323,326,331,334,339,342,347,350,355,358,363,367,369,374,377,382,384,389,392,397,399,404,407,412,414,419,422,427,431,434,439,441,446,448,453,456,461,464,469,472,477,479,484,486,491,495,498,503,506,511,514,519,522,527,531,534,555,560,563,568,571,576,579,584,587,605,610],[11,12,14],"h2",{"id":13},"foreword","Foreword",[16,17,18],"p",{},"In this entry I would like to show you how to install ADFS.",[11,20,22],{"id":21},"prerequisites","Prerequisites",[24,25],"br",{},[27,28,29,33,36],"ul",{},[30,31,32],"li",{},"Separate VLAN for the ADFS Server",[30,34,35],{},"Windows Server, domainjoined (Server 2025 in this example)",[30,37,38],{},"Certificate (issued by Windows PKI or external CA, will be addressed later in the guide)",[24,40],{},[11,42,44],{"id":43},"install-adfs-role","Install ADFS Role",[16,46,47],{},"Open the Server Manager.",[16,49,50],{},[51,52],"img",{"alt":53,"src":54},"","\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F1.webp",[16,56,57],{},"On the top right, click on \"Manage\" and select \"Add Roles and Features\".",[16,59,60],{},[51,61],{"alt":53,"src":62},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F2.webp",[16,64,65],{},"Click on next.",[16,67,68],{},[51,69],{"alt":53,"src":70},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F3.webp",[16,72,73],{},"Select \"Role-based or feature-based installation\".",[16,75,76],{},[51,77],{"alt":53,"src":78},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F4.webp",[16,80,81],{},"Select the server and click next.",[16,83,84],{},[51,85],{"alt":53,"src":86},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F5.webp",[16,88,89],{},"Search the \"Active Directory Federation Services\" option.",[16,91,92],{},[51,93],{"alt":53,"src":94},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F6.webp",[16,96,97],{},"Tick the box and click on next.",[16,99,100],{},[51,101],{"alt":53,"src":102},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F7.webp",[16,104,105],{},"We don't need any features so just click next.",[16,107,108],{},[51,109],{"alt":53,"src":110},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F8.webp",[16,112,113],{},"Just click on next again.",[16,115,116],{},[51,117],{"alt":53,"src":118},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F9.webp",[16,120,121],{},"Confirm the installation and click on install.",[16,123,124],{},[51,125],{"alt":53,"src":126},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F10.webp",[16,128,129],{},"Wait until the installation is finished.",[16,131,132],{},[51,133],{"alt":53,"src":134},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F11.webp",[16,136,137],{},"It can take some minutes. It looks like this once complete.",[16,139,140],{},[51,141],{"alt":53,"src":142},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F12.webp",[16,144,145],{},"You should now see a yellow warning in the top right of your Server Manager.",[16,147,148],{},[51,149],{"alt":53,"src":150},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F13_1.webp",[16,152,153],{},"Click on the warning and select \"Configure the federation Service on this server.\".",[16,155,156],{},[51,157],{"alt":53,"src":158},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F14_1.webp",[16,160,161],{},"Select \"Create the first federation server in a federation server farm\" if that is your first server (probably).",[16,163,164],{},[51,165],{"alt":53,"src":166},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F15.webp",[16,168,169],{},"Make sure that you are logged on to the server with an account that has domain administrator rights.",[16,171,172],{},[51,173],{"alt":53,"src":174},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F16.webp",[16,176,177],{},"You will now need to select your certificate for the ADFS and specify a name.",[16,179,180],{},[51,181],{"alt":53,"src":182},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F17.webp",[16,184,185],{},"It should look like this.",[16,187,188],{},[51,189],{"alt":53,"src":190},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F18.webp",[16,192,193],{},"You need a certificate with the following SANs:",[27,195,196,199,202,205,208,211,214,217],{},[30,197,198],{},"adfs.your.domain",[30,200,201],{},"enterpriseregistration.your.domain",[30,203,204],{},"enterpriseregistration.your.internal.domain",[30,206,207],{},"enterpriseregistration.your.adfs.domain",[30,209,210],{},"certauth.your.adfs.domain",[30,212,213],{},"hostname-of-your-server",[30,215,216],{},"fqdn-of-your-server",[30,218,219],{},"IP-Address of your Server",[16,221,222],{},[51,223],{"alt":53,"src":224},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fcert.webp",[16,226,227],{},"If you followed my PKI installation guide, you can use the \"Web Server\" template for that. See here: \u002Fp\u002Fwindows-pki-installation\u002F#create-new-template-web-server",[16,229,230],{},"A gMSA account should be used for the ADFS service account. These accounts offer more security than normal “AD Service Accounts”.\nIf gMSA accounts have never been used in the domain before, a KDS root key must be set first.",[16,232,233],{},[51,234],{"alt":53,"src":235},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F20.webp",[16,237,238],{},"This is also displayed at the top as a warning message.\nIf you click on the warning message, you will receive this message.",[16,240,241],{},[51,242],{"alt":53,"src":243},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F21.webp",[16,245,246],{},"To create the KDS-Root-Key, you must execute the following command on one of your domain controllers:",[248,249,253],"pre",{"className":250,"code":251,"language":252,"meta":53,"style":53},"language-powershell shiki shiki-themes gruvbox-dark-medium","Add-KdsRootKey\n","powershell",[254,255,256],"code",{"__ignoreMap":53},[257,258,261],"span",{"class":259,"line":260},"line",1,[257,262,251],{"class":263},"s59W0",[16,265,266],{},"You should then wait 10 hours to ensure that it is completely replicated in the entire domain. There are methods to bypass the 10-hour waiting time, but these are not recommended by Microsoft. The best way is therefore to wait the 10 hours.\nYou can use the following command to skip the 10 hour waiting time (not recommended):",[248,268,270],{"className":250,"code":269,"language":252,"meta":53,"style":53},"Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)\n",[254,271,272],{"__ignoreMap":53},[257,273,274,277,281,285,289,292,295,298,300,304],{"class":259,"line":260},[257,275,276],{"class":263},"Add-KdsRootKey",[257,278,280],{"class":279},"sM2RB"," -",[257,282,284],{"class":283},"sM0OT","EffectiveTime ",[257,286,288],{"class":287},"svnLg","(",[257,290,291],{"class":263},"Get-Date",[257,293,294],{"class":287},")",[257,296,297],{"class":283},".AddHours",[257,299,288],{"class":287},[257,301,303],{"class":302},"ssIPD","-10",[257,305,306],{"class":287},")\n",[16,308,309],{},"After waiting 10 hours and restarting the configuration setup, the message disappears.",[16,311,312],{},[51,313],{"alt":53,"src":314},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F22.webp",[16,316,317],{},"A name must now be assigned to the gMSA account. In my case, I use “gMSA_ADFS”.",[16,319,320],{},[51,321],{"alt":53,"src":322},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F23.webp",[16,324,325],{},"Select \"Create a database on this server using Windows Internal Database\".\nThis is easily sufficient for a Homelab environment. For large ADFS farms, a dedicated SQL database should be used.",[16,327,328],{},[51,329],{"alt":53,"src":330},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F24.webp",[16,332,333],{},"Review the options and click next.",[16,335,336],{},[51,337],{"alt":53,"src":338},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F25.webp",[16,340,341],{},"If you have generated the KDS root key but have not waited 10 hours, the following warning message will appear during the prerequisite check.",[16,343,344],{},[51,345],{"alt":53,"src":346},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F26.webp",[16,348,349],{},"If you have waited the 10 hours, the prerequisite check should look like this. Click on configure.",[16,351,352],{},[51,353],{"alt":53,"src":354},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F27.webp",[16,356,357],{},"Wait until the configuration is done.",[16,359,360],{},[51,361],{"alt":53,"src":362},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F28.webp",[11,364,366],{"id":365},"configure-dns","Configure DNS",[24,368],{},[370,371,373],"h3",{"id":372},"configure-forward-lookup-zone","Configure Forward Lookup Zone",[16,375,376],{},"Open the DNS Manager on the domain controller or your management machine and right-click on “Forward Lookup Zones” and select “New Zone...”.",[16,378,379],{},[51,380],{"alt":53,"src":381},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_1.webp",[16,383,65],{},[16,385,386],{},[51,387],{"alt":53,"src":388},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_2.webp",[16,390,391],{},"Click next again.",[16,393,394],{},[51,395],{"alt":53,"src":396},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_3.webp",[16,398,391],{},[16,400,401],{},[51,402],{"alt":53,"src":403},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_4.webp",[16,405,406],{},"Enter the zone name. It should be your ADFS domain. In my example it's \"adfs.nobrac.ch\".",[16,408,409],{},[51,410],{"alt":53,"src":411},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_5.webp",[16,413,65],{},[16,415,416],{},[51,417],{"alt":53,"src":418},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_6.webp",[16,420,421],{},"Click on finish.",[16,423,424],{},[51,425],{"alt":53,"src":426},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_7.webp",[370,428,430],{"id":429},"configure-reverse-lookup-zone","Configure Reverse Lookup Zone",[16,432,433],{},"Open the DNS Manager on the domain controller or your management machine and right-click on “Reverse Lookup Zones” and select “New Zone...”.",[16,435,436],{},[51,437],{"alt":53,"src":438},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_10.webp",[16,440,65],{},[16,442,443],{},[51,444],{"alt":53,"src":445},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_11.webp",[16,447,65],{},[16,449,450],{},[51,451],{"alt":53,"src":452},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_12.webp",[16,454,455],{},"Click again on next.",[16,457,458],{},[51,459],{"alt":53,"src":460},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_13.webp",[16,462,463],{},"Select \"IPv4 Reverse Lookup Zone\".",[16,465,466],{},[51,467],{"alt":53,"src":468},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_14.webp",[16,470,471],{},"Enter your network and click on next.",[16,473,474],{},[51,475],{"alt":53,"src":476},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_15.webp",[16,478,65],{},[16,480,481],{},[51,482],{"alt":53,"src":483},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_16.webp",[16,485,421],{},[16,487,488],{},[51,489],{"alt":53,"src":490},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_17.webp",[370,492,494],{"id":493},"create-a-record","Create A-Record",[16,496,497],{},"Now select the newly created Forward Lookup Zone (in my case “adfs.nobrac.ch”) in the DNS Manager and right-click in the free area on the right and select “New Host (A or AAAA)...”.",[16,499,500],{},[51,501],{"alt":53,"src":502},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_19.webp",[16,504,505],{},"Leave the name blank and enter the IP-Address of your ADFS-Server. Make sure that the box for creating the PTR-Record is checked.",[16,507,508],{},[51,509],{"alt":53,"src":510},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_20.webp",[16,512,513],{},"The record got successfully created.",[16,515,516],{},[51,517],{"alt":53,"src":518},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_21.webp",[16,520,521],{},"You should see the new entry in the overview.",[16,523,524],{},[51,525],{"alt":53,"src":526},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002Fdns_22.webp",[11,528,530],{"id":529},"test-the-login","Test the login",[16,532,533],{},"After configuration, open Powershell with administrative rights. Enter the following command to activate the ADFS login test page. This is deactivated by default from Windows Server 2016.",[248,535,537],{"className":250,"code":536,"language":252,"meta":53,"style":53},"Set-AdfsProperties -EnableIdpInitiatedSignonPage $true\n",[254,538,539],{"__ignoreMap":53},[257,540,541,544,546,549,552],{"class":259,"line":260},[257,542,543],{"class":263},"Set-AdfsProperties",[257,545,280],{"class":279},[257,547,548],{"class":283},"EnableIdpInitiatedSignonPage ",[257,550,551],{"class":287},"$",[257,553,554],{"class":302},"true\n",[16,556,557],{},[51,558],{"alt":53,"src":559},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F29.webp",[16,561,562],{},"Open the ADFS website in a browser of your choice. Click on \"Sign in\".",[16,564,565],{},[51,566],{"alt":53,"src":567},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F30.webp",[16,569,570],{},"Enter the credentials from the domain administrator for testing.",[16,572,573],{},[51,574],{"alt":53,"src":575},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F31.webp",[16,577,578],{},"If the page displays “You are signed in.”, everything works as it should.",[16,580,581],{},[51,582],{"alt":53,"src":583},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F32.webp",[16,585,586],{},"At the end, the ADFS login test page should be deactivated again. Dies geht mit folgendem Befehl.",[248,588,590],{"className":250,"code":589,"language":252,"meta":53,"style":53},"Set-AdfsProperties -EnableIdpInitiatedSignonPage $false\n",[254,591,592],{"__ignoreMap":53},[257,593,594,596,598,600,602],{"class":259,"line":260},[257,595,543],{"class":263},[257,597,280],{"class":279},[257,599,548],{"class":283},[257,601,551],{"class":287},[257,603,604],{"class":302},"false\n",[16,606,607],{},[51,608],{"alt":53,"src":609},"\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fattachments\u002F33.webp",[611,612,613],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}",{"title":53,"searchDepth":615,"depth":615,"links":616},3,[617,619,620,621,626],{"id":13,"depth":618,"text":14},2,{"id":21,"depth":618,"text":22},{"id":43,"depth":618,"text":44},{"id":365,"depth":618,"text":366,"children":622},[623,624,625],{"id":372,"depth":615,"text":373},{"id":429,"depth":615,"text":430},{"id":493,"depth":615,"text":494},{"id":529,"depth":618,"text":530},"active-directory","2025-01-27","Basic installation guide for Active Directory Federation Services",false,"md","\u002Fimages\u002Fposts\u002Fadfs-installation\u002Fcover.webp",{},true,"\u002Fposts\u002Fadfs-installation",4,{"title":5,"description":629},"posts\u002Fadfs-installation","2",[641],"adfs","m_pETaksPmdg4l41XBuk98V-7cGX5AsTRJJYBHRg8DU",[644,658,669,679,687,694,703,711,717,725,731,741,748,750,757,763,770,776,782,790,802,809,817,823,830,836,842,849,855,861,867,873,880,886,892,900,907,914],{"path":645,"title":646,"description":647,"date":648,"category":649,"alsoIn":650,"series":6,"tags":652,"readingTime":657},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[651],"windows",[651,653,654,655,656],"lsa","2fa","credential-provider","security",9,{"path":659,"title":660,"description":661,"date":662,"category":651,"alsoIn":663,"series":664,"tags":665,"readingTime":668},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[649],"Doppio · 3-part series",[651,653,666,667,654,656],"ntlm","smb",35,{"path":670,"title":671,"description":672,"date":673,"category":649,"alsoIn":6,"series":6,"tags":674,"readingTime":678},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[627,675,252,676,666,677],"windows-server","hardening","kerberos",5,{"path":680,"title":681,"description":682,"date":683,"category":649,"alsoIn":6,"series":6,"tags":684,"readingTime":686},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[627,666,677,685,675],"auditing",6,{"path":688,"title":689,"description":690,"date":691,"category":651,"alsoIn":6,"series":664,"tags":692,"readingTime":693},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[651,655,653,654,656],32,{"path":695,"title":696,"description":697,"date":698,"category":651,"alsoIn":699,"series":664,"tags":700,"readingTime":702},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[649],[651,655,654,701,656],"totp",60,{"path":704,"title":705,"description":706,"date":707,"category":649,"alsoIn":6,"series":6,"tags":708,"readingTime":615},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[627,675,252,709,710],"tiering","laps",{"path":712,"title":713,"description":714,"date":707,"category":627,"alsoIn":6,"series":6,"tags":715,"readingTime":716},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":718,"title":719,"description":720,"date":721,"category":722,"alsoIn":6,"series":6,"tags":723,"readingTime":615},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[724],"tor",{"path":726,"title":727,"description":728,"date":729,"category":627,"alsoIn":6,"series":6,"tags":730,"readingTime":260},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[677],{"path":732,"title":733,"description":734,"date":735,"category":736,"alsoIn":6,"series":6,"tags":737,"readingTime":740},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[736,738,739],"exchange-se","exchange-2019",47,{"path":742,"title":743,"description":744,"date":745,"category":627,"alsoIn":6,"series":6,"tags":746,"readingTime":657},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[666,627,747],"authentication",{"path":635,"title":5,"description":629,"date":628,"category":627,"alsoIn":6,"series":6,"tags":749,"readingTime":636},[641],{"path":751,"title":752,"description":753,"date":754,"category":627,"alsoIn":6,"series":6,"tags":755,"readingTime":615},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[756],"pass-the-hash",{"path":758,"title":759,"description":760,"date":761,"category":627,"alsoIn":6,"series":6,"tags":762,"readingTime":686},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[677],{"path":764,"title":765,"description":766,"date":767,"category":651,"alsoIn":6,"series":6,"tags":768,"readingTime":615},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[769],"credential-guard",{"path":771,"title":772,"description":773,"date":774,"category":651,"alsoIn":6,"series":6,"tags":775,"readingTime":636},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[769],{"path":777,"title":778,"description":779,"date":774,"category":651,"alsoIn":6,"series":6,"tags":780,"readingTime":615},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[781],"osconfig",{"path":783,"title":784,"description":785,"date":786,"category":651,"alsoIn":6,"series":6,"tags":787,"readingTime":615},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[788,789],"iis","modsecurity",{"path":791,"title":792,"description":793,"date":794,"category":627,"alsoIn":6,"series":6,"tags":795,"readingTime":801},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[796,797,798,799,800],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":803,"title":804,"description":805,"date":806,"category":627,"alsoIn":6,"series":6,"tags":807,"readingTime":808},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[796,797],36,{"path":810,"title":811,"description":812,"date":813,"category":814,"alsoIn":6,"series":6,"tags":815,"readingTime":801},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[816,651,627],"writeup",{"path":818,"title":819,"description":820,"date":821,"category":627,"alsoIn":6,"series":6,"tags":822,"readingTime":618},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":824,"title":825,"description":826,"date":827,"category":814,"alsoIn":6,"series":6,"tags":828,"readingTime":829},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[816,722],12,{"path":831,"title":832,"description":833,"date":834,"category":814,"alsoIn":6,"series":6,"tags":835,"readingTime":657},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[816,722],{"path":837,"title":838,"description":839,"date":840,"category":814,"alsoIn":6,"series":6,"tags":841,"readingTime":260},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[816,651,627],{"path":843,"title":844,"description":845,"date":846,"category":814,"alsoIn":6,"series":6,"tags":847,"readingTime":848},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[816,722],7,{"path":850,"title":851,"description":852,"date":853,"category":814,"alsoIn":6,"series":6,"tags":854,"readingTime":615},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[816,722],{"path":856,"title":857,"description":858,"date":859,"category":814,"alsoIn":6,"series":6,"tags":860,"readingTime":260},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[816,722],{"path":862,"title":863,"description":864,"date":865,"category":814,"alsoIn":6,"series":6,"tags":866,"readingTime":615},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[816,722],{"path":868,"title":869,"description":870,"date":871,"category":814,"alsoIn":6,"series":6,"tags":872,"readingTime":636},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[816,722],{"path":874,"title":875,"description":876,"date":877,"category":814,"alsoIn":6,"series":6,"tags":878,"readingTime":678},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[816,879],"freebsd",{"path":881,"title":882,"description":883,"date":884,"category":814,"alsoIn":6,"series":6,"tags":885,"readingTime":716},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[816,651],{"path":887,"title":888,"description":889,"date":890,"category":814,"alsoIn":6,"series":6,"tags":891,"readingTime":615},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[816,651],{"path":893,"title":894,"description":895,"date":896,"category":722,"alsoIn":6,"series":6,"tags":897,"readingTime":260},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[898,899],"ssh","monitoring",{"path":901,"title":902,"description":903,"date":904,"category":814,"alsoIn":6,"series":6,"tags":905,"readingTime":906},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[816,651,627],16,{"path":908,"title":909,"description":910,"date":911,"category":736,"alsoIn":6,"series":6,"tags":912,"readingTime":260},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[913,252],"m365",{"path":915,"title":916,"description":917,"date":918,"category":736,"alsoIn":6,"series":6,"tags":919,"readingTime":260},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195052858]