[{"data":1,"prerenderedAt":636},["ShallowReactive",2],{"post-configure-credential-guard-windows":3,"post-list":357},{"id":4,"title":5,"alsoIn":6,"body":7,"category":342,"date":343,"description":344,"draft":345,"extension":346,"image":347,"links":6,"meta":348,"navigation":349,"order":6,"path":350,"readingTime":333,"seo":351,"series":6,"stem":352,"strength":353,"tags":354,"unlisted":345,"updated":6,"__hash__":356},"posts\u002Fposts\u002Fconfigure-credential-guard-windows.md","Configure Credential Guard",null,{"type":8,"value":9,"toc":320},"minimark",[10,15,19,22,25,28,31,34,37,44,48,51,54,73,75,79,82,87,90,95,99,102,107,111,113,118,121,124,129,132,137,140,145,148,151,156,159,164,167,172,177,180,183,188,192,195,200,204,207,212,215,220,223,228,232,235,240,243,248,252,254,258,261,265,268,278,283,286,291,294,299,303,306,310,314,317],[11,12,14],"h2",{"id":13},"foreword","Foreword",[16,17,18],"p",{},"Starting in Windows 11, 22H2 and Windows Server 2025, Credential Guard is enabled by default on devices which meet the requirements.",[16,20,21],{},"So this is important for Clients below Windows 11 and Servers below Windows Server 2025.",[16,23,24],{},"If a device has Credential Guard explicitly turned off before updating to a newer version of Windows where Credential Guard is enabled by default, it will remain disabled even after the update.",[16,26,27],{},"Credential Guard should be enabled before a device is joined to a domain or before a domain user signs in for the first time. If Credential Guard is enabled after domain join, the user and device secrets may already be compromised.",[16,29,30],{},"Kerberos, NTLM, and Credential Manager isolate secrets by using Virtualization-based security (VBS). Previous versions of Windows stored secrets in its process memory, in the Local Security Authority (LSA) process lsass.exe.",[16,32,33],{},"With Credential Guard enabled, the LSA process in the operating system talks to a component called the isolated LSA process that stores and protects those secrets, LSAIso.exe. Data stored by the isolated LSA process is protected using VBS and isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.",[16,35,36],{},"For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All the binaries are signed with a certificate that VBS trusts, and the signatures are validated before launching the file in the protected environment.",[16,38,39],{},[40,41],"img",{"alt":42,"src":43},"","\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F15.webp",[11,45,47],{"id":46},"warning","Warning",[16,49,50],{},"Enabling Credential Guard on domain controllers isn't recommended. Credential Guard doesn't provide any added security to domain controllers, and can cause application compatibility issues on domain controllers.",[16,52,53],{},"Applications break if they require:",[55,56,57,61,64,67],"ul",{},[58,59,60],"li",{},"Kerberos DES encryption support",[58,62,63],{},"Kerberos unconstrained delegation",[58,65,66],{},"Kerberos TGT extraction",[58,68,69,70],{},"NTLMv1\n",[71,72],"br",{},[71,74],{},[11,76,78],{"id":77},"prerequisites","Prerequisites",[16,80,81],{},"Virtualization Based Security needs to be enabled on virtual machines that are hosted on VMware. You can enable it in the settings of each VM.",[16,83,84],{},[40,85],{"alt":42,"src":86},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002Fvbs1.webp",[16,88,89],{},"You can also see it in the VM overview under the “Guest OS” tab.",[16,91,92],{},[40,93],{"alt":42,"src":94},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002Fvbs2.webp",[11,96,98],{"id":97},"credential-guard-disabled","Credential Guard Disabled",[16,100,101],{},"When Credential Guard is disabled, attackers can use tools such as Mimikatz to extract the NTLM-Hash.",[16,103,104],{},[40,105],{"alt":42,"src":106},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F1.webp",[11,108,110],{"id":109},"enable-credential-guard","Enable Credential Guard",[71,112],{},[114,115,117],"h3",{"id":116},"create-gpo","Create GPO",[16,119,120],{},"Open the Group Policy Managment Console.",[16,122,123],{},"Right-click on the \"Group Policy Objects\" folder and select \"New\".",[16,125,126],{},[40,127],{"alt":42,"src":128},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F2.webp",[16,130,131],{},"Choose a name for the GPO.",[16,133,134],{},[40,135],{"alt":42,"src":136},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F3.webp",[16,138,139],{},"Right-click the newly created GPO and select \"Edit\".",[16,141,142],{},[40,143],{"alt":42,"src":144},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F4.webp",[16,146,147],{},"Navigate to the following path:",[16,149,150],{},"Computer Configuration -> Policies -> Administrative Templates -> System -> Device Guard",[16,152,153],{},[40,154],{"alt":42,"src":155},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F5.webp",[16,157,158],{},"Do a right-click on the \"Turn On Virtualization Based Security\" policy and select \"Edit\".",[16,160,161],{},[40,162],{"alt":42,"src":163},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F6.webp",[16,165,166],{},"You should see the following window.",[16,168,169],{},[40,170],{"alt":42,"src":171},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F7.webp",[173,174,176],"h4",{"id":175},"enabled-with-uefi-lock","Enabled with UEFI Lock",[16,178,179],{},"Enable the policy. Select \"Secure Boot and DMA Protection\" for the Platform Security Level.",[16,181,182],{},"There are two important configuration options for the \"Credential Guard Configuration\" dropdown. The first one is \"Enabled with UEFI lock\". The advantage of it is: Attackers can't just disable Credential Guard with GPO or Registry. If you want to disable it, you will need to confirm the deactivation at the reboot of the computer or virtual machine. So an attacker needs to be in front of the Computer or need to have access to the Hypervisor.",[16,184,185],{},[40,186],{"alt":42,"src":187},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F8.webp",[173,189,191],{"id":190},"enabled-without-lock","Enabled without Lock",[16,193,194],{},"The other option is \"Enabled without lock\". Attackers could disable Credential Guard with GPO or Registry. However, it can be easier for administrators to manage, as they do not have to stand in front of the computer to manually deactivate it during a reboot.",[16,196,197],{},[40,198],{"alt":42,"src":199},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F8_1.webp",[11,201,203],{"id":202},"link-the-gpo","Link the GPO",[16,205,206],{},"Link the GPO to an OU in which you want to activate Credential Guard. In my example, it is the “Computers” OU.\nDo a right-click on the OU and select \"Link an Existing GPO...\".",[16,208,209],{},[40,210],{"alt":42,"src":211},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F9.webp",[16,213,214],{},"Select the newly created GPO.",[16,216,217],{},[40,218],{"alt":42,"src":219},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F10.webp",[16,221,222],{},"It should look like this.",[16,224,225],{},[40,226],{"alt":42,"src":227},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F11.webp",[11,229,231],{"id":230},"check-if-its-working","Check if it's working",[16,233,234],{},"If Credential Guard has been successfully activated, a new process exists in the Task Manager. This is called “Lsalso.exe” with the description “Credential Guard & Key Guard”.",[16,236,237],{},[40,238],{"alt":42,"src":239},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F12.webp",[16,241,242],{},"Attackers can no longer extract the NTLM hash with Mimikatz, for example, as the hash is now protected by Credential Guard. Mimikatz displays the information \"LSA Isolated Data: NtlmHash\".",[16,244,245],{},[40,246],{"alt":42,"src":247},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F13.webp",[11,249,251],{"id":250},"disable-credential-guard","Disable Credential Guard",[71,253],{},[114,255,257],{"id":256},"disable-with-uefi-lock","Disable with UEFI Lock",[16,259,260],{},"To disable Credential Guard with the UEFI Lock configuration, you will need to set the GPO you created before to the option \"Not Configured\" or \"Disabled\".",[16,262,263],{},[40,264],{"alt":42,"src":171},[16,266,267],{},"After that, you will need to enter the following commands into an administrative CMD.",[269,270,275],"pre",{"className":271,"code":273,"language":274,"meta":42},[272],"language-text","mountvol X: \u002Fs\ncopy %WINDIR%\\System32\\SecConfig.efi X:\\EFI\\Microsoft\\Boot\\SecConfig.efi \u002FY\nbcdedit \u002Fcreate {0cb3b571-2f2e-4343-a879-d86a476d7215} \u002Fd \"DebugTool\" \u002Fapplication osloader\nbcdedit \u002Fset {0cb3b571-2f2e-4343-a879-d86a476d7215} path \"\\EFI\\Microsoft\\Boot\\SecConfig.efi\"\nbcdedit \u002Fset {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}\nbcdedit \u002Fset {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO\nbcdedit \u002Fset {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:\nmountvol X: \u002Fd\n","text",[276,277,273],"code",{"__ignoreMap":42},[16,279,280],{},[40,281],{"alt":42,"src":282},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002F14.webp",[16,284,285],{},"When you reboot the Computer or Server, you will need to confirm the deactivation of Credential Guard with the Windows key or F3 key.",[16,287,288],{},[40,289],{"alt":42,"src":290},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002Fcredguard.webp",[16,292,293],{},"If you press one of the keys, Credential Guard got successfully disabled.",[16,295,296],{},[40,297],{"alt":42,"src":298},"\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fattachments\u002Fcredguard2.webp",[114,300,302],{"id":301},"disable-without-lock","Disable without Lock",[16,304,305],{},"To disable Credential Guard without the UEFI Lock configuration, you will just need to set the GPO you created before to the option \"Not Configured\" or \"Disabled\".\nReboot your Computer or Server afterwards.",[16,307,308],{},[40,309],{"alt":42,"src":171},[11,311,313],{"id":312},"conclusion","Conclusion",[16,315,316],{},"Your environment is now better protected against credential theft attacks. NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs) and credentials stored by applications as domain credentials are now secured by Credential Guard.",[16,318,319],{},"If you would also like to secure computer accounts with Credential Guard, you can view the following blog entry from me: \u002Fp\u002Fconfigure-credential-guard-computer-accounts\u002F",{"title":42,"searchDepth":321,"depth":321,"links":322},3,[323,325,326,327,328,335,336,337,341],{"id":13,"depth":324,"text":14},2,{"id":46,"depth":324,"text":47},{"id":77,"depth":324,"text":78},{"id":97,"depth":324,"text":98},{"id":109,"depth":324,"text":110,"children":329},[330],{"id":116,"depth":321,"text":117,"children":331},[332,334],{"id":175,"depth":333,"text":176},4,{"id":190,"depth":333,"text":191},{"id":202,"depth":324,"text":203},{"id":230,"depth":324,"text":231},{"id":250,"depth":324,"text":251,"children":338},[339,340],{"id":256,"depth":321,"text":257},{"id":301,"depth":321,"text":302},{"id":312,"depth":324,"text":313},"windows","2025-01-13","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.",false,"md","\u002Fimages\u002Fposts\u002Fconfigure-credential-guard-windows\u002Fcover.webp",{},true,"\u002Fposts\u002Fconfigure-credential-guard-windows",{"title":5,"description":344},"posts\u002Fconfigure-credential-guard-windows","1",[355],"credential-guard","DnSZNGHFsN3sWQS53yYp3aKxDPWIMRxBaczWCvrrNig",[358,371,382,394,402,409,418,426,432,440,447,457,464,471,478,484,490,492,498,506,518,525,533,539,546,552,558,565,571,577,583,589,596,602,608,616,623,630],{"path":359,"title":360,"description":361,"date":362,"category":363,"alsoIn":364,"series":6,"tags":365,"readingTime":370},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[342],[342,366,367,368,369],"lsa","2fa","credential-provider","security",9,{"path":372,"title":373,"description":374,"date":375,"category":342,"alsoIn":376,"series":377,"tags":378,"readingTime":381},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[363],"Doppio · 3-part series",[342,366,379,380,367,369],"ntlm","smb",35,{"path":383,"title":384,"description":385,"date":386,"category":363,"alsoIn":6,"series":6,"tags":387,"readingTime":393},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[388,389,390,391,379,392],"active-directory","windows-server","powershell","hardening","kerberos",5,{"path":395,"title":396,"description":397,"date":398,"category":363,"alsoIn":6,"series":6,"tags":399,"readingTime":401},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[388,379,392,400,389],"auditing",6,{"path":403,"title":404,"description":405,"date":406,"category":342,"alsoIn":6,"series":377,"tags":407,"readingTime":408},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[342,368,366,367,369],32,{"path":410,"title":411,"description":412,"date":413,"category":342,"alsoIn":414,"series":377,"tags":415,"readingTime":417},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[363],[342,368,367,416,369],"totp",60,{"path":419,"title":420,"description":421,"date":422,"category":363,"alsoIn":6,"series":6,"tags":423,"readingTime":321},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[388,389,390,424,425],"tiering","laps",{"path":427,"title":428,"description":429,"date":422,"category":388,"alsoIn":6,"series":6,"tags":430,"readingTime":431},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":433,"title":434,"description":435,"date":436,"category":437,"alsoIn":6,"series":6,"tags":438,"readingTime":321},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[439],"tor",{"path":441,"title":442,"description":443,"date":444,"category":388,"alsoIn":6,"series":6,"tags":445,"readingTime":446},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[392],1,{"path":448,"title":449,"description":450,"date":451,"category":452,"alsoIn":6,"series":6,"tags":453,"readingTime":456},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[452,454,455],"exchange-se","exchange-2019",47,{"path":458,"title":459,"description":460,"date":461,"category":388,"alsoIn":6,"series":6,"tags":462,"readingTime":370},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[379,388,463],"authentication",{"path":465,"title":466,"description":467,"date":468,"category":388,"alsoIn":6,"series":6,"tags":469,"readingTime":333},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[470],"adfs",{"path":472,"title":473,"description":474,"date":475,"category":388,"alsoIn":6,"series":6,"tags":476,"readingTime":321},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[477],"pass-the-hash",{"path":479,"title":480,"description":481,"date":482,"category":388,"alsoIn":6,"series":6,"tags":483,"readingTime":401},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[392],{"path":485,"title":486,"description":487,"date":488,"category":342,"alsoIn":6,"series":6,"tags":489,"readingTime":321},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[355],{"path":350,"title":5,"description":344,"date":343,"category":342,"alsoIn":6,"series":6,"tags":491,"readingTime":333},[355],{"path":493,"title":494,"description":495,"date":343,"category":342,"alsoIn":6,"series":6,"tags":496,"readingTime":321},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[497],"osconfig",{"path":499,"title":500,"description":501,"date":502,"category":342,"alsoIn":6,"series":6,"tags":503,"readingTime":321},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[504,505],"iis","modsecurity",{"path":507,"title":508,"description":509,"date":510,"category":388,"alsoIn":6,"series":6,"tags":511,"readingTime":517},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[512,513,514,515,516],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":519,"title":520,"description":521,"date":522,"category":388,"alsoIn":6,"series":6,"tags":523,"readingTime":524},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[512,513],36,{"path":526,"title":527,"description":528,"date":529,"category":530,"alsoIn":6,"series":6,"tags":531,"readingTime":517},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[532,342,388],"writeup",{"path":534,"title":535,"description":536,"date":537,"category":388,"alsoIn":6,"series":6,"tags":538,"readingTime":324},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":540,"title":541,"description":542,"date":543,"category":530,"alsoIn":6,"series":6,"tags":544,"readingTime":545},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[532,437],12,{"path":547,"title":548,"description":549,"date":550,"category":530,"alsoIn":6,"series":6,"tags":551,"readingTime":370},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[532,437],{"path":553,"title":554,"description":555,"date":556,"category":530,"alsoIn":6,"series":6,"tags":557,"readingTime":446},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[532,342,388],{"path":559,"title":560,"description":561,"date":562,"category":530,"alsoIn":6,"series":6,"tags":563,"readingTime":564},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[532,437],7,{"path":566,"title":567,"description":568,"date":569,"category":530,"alsoIn":6,"series":6,"tags":570,"readingTime":321},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[532,437],{"path":572,"title":573,"description":574,"date":575,"category":530,"alsoIn":6,"series":6,"tags":576,"readingTime":446},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[532,437],{"path":578,"title":579,"description":580,"date":581,"category":530,"alsoIn":6,"series":6,"tags":582,"readingTime":321},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[532,437],{"path":584,"title":585,"description":586,"date":587,"category":530,"alsoIn":6,"series":6,"tags":588,"readingTime":333},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[532,437],{"path":590,"title":591,"description":592,"date":593,"category":530,"alsoIn":6,"series":6,"tags":594,"readingTime":393},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[532,595],"freebsd",{"path":597,"title":598,"description":599,"date":600,"category":530,"alsoIn":6,"series":6,"tags":601,"readingTime":431},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[532,342],{"path":603,"title":604,"description":605,"date":606,"category":530,"alsoIn":6,"series":6,"tags":607,"readingTime":321},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[532,342],{"path":609,"title":610,"description":611,"date":612,"category":437,"alsoIn":6,"series":6,"tags":613,"readingTime":446},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[614,615],"ssh","monitoring",{"path":617,"title":618,"description":619,"date":620,"category":530,"alsoIn":6,"series":6,"tags":621,"readingTime":622},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[532,342,388],16,{"path":624,"title":625,"description":626,"date":627,"category":452,"alsoIn":6,"series":6,"tags":628,"readingTime":446},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[629,390],"m365",{"path":631,"title":632,"description":633,"date":634,"category":452,"alsoIn":6,"series":6,"tags":635,"readingTime":446},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195054428]