[{"data":1,"prerenderedAt":784},["ShallowReactive",2],{"post-how-ntlm-works-active-directory":3,"post-list":507},{"id":4,"title":5,"alsoIn":6,"body":7,"category":485,"date":486,"description":487,"draft":488,"extension":489,"image":490,"links":6,"meta":491,"navigation":492,"order":493,"path":497,"readingTime":498,"seo":499,"series":6,"stem":500,"strength":501,"tags":502,"unlisted":488,"updated":505,"__hash__":506},"posts\u002Fposts\u002Fhow-ntlm-works-active-directory.md","How NTLM works in Active Directory",null,{"type":8,"value":9,"toc":458},"minimark",[10,15,25,29,39,42,45,48,51,55,64,67,74,79,82,85,89,92,95,99,102,105,113,117,122,125,129,132,135,138,141,145,149,152,156,159,162,166,169,175,188,191,194,198,273,281,285,324,328,331,337,340,361,368,372,419,423,455],[11,12,14],"h2",{"id":13},"foreword","Foreword",[16,17,18,19,24],"p",{},"In this entry I would like to explain how NTLM works in an Active Directory environment. It's the counterpart to my article about ",[20,21,23],"a",{"href":22},"\u002Fp\u002Fhow-kerberos-works-active-directory\u002F","how Kerberos works",". Kerberos has been the default for more than 20 years, but NTLM is still in almost every domain I see. Before you can get rid of it, you have to understand what it does.",[11,26,28],{"id":27},"ntlm-authentication","NTLM Authentication",[16,30,31,32,38],{},"All ",[20,33,37],{"href":34,"rel":35},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Fkerberos\u002Fntlm-overview",[36],"nofollow","NTLM protocols"," use a challenge-response mechanism to authenticate users and computers. The user proves to the server that they know their account password, without sending the password over the network.",[16,40,41],{},"NTLM was introduced in 1993 with Windows NT 3.1 and replaced the older LM hash method, which had significant security flaws. NTLM had vulnerabilities as well, so Microsoft released NTLMv2 with Windows NT 4.0 SP4. From then on, the original version was called NTLMv1.",[16,43,44],{},"With Windows 2000, Kerberos became the default authentication protocol for Active Directory domains.",[16,46,47],{},"NTLM is still supported for backward compatibility, and you still see it in a lot of places. It's used with local accounts and in workgroups, when someone connects to a server by IP address instead of its name, and by older applications and devices that don't speak Kerberos.",[16,49,50],{},"NTLM doesn't have its own port. It travels inside the protocol you are using anyway, for example SMB, HTTP, LDAP or RPC.",[11,52,54],{"id":53},"the-three-messages","The three messages",[16,56,57,58,63],{},"An NTLM authentication always consists of three messages between client and server. Microsoft calls them NEGOTIATE, CHALLENGE and AUTHENTICATE in the ",[20,59,62],{"href":60,"rel":61},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-nlmp\u002F",[36],"protocol specification",". In older documentation and in Wireshark you also see them as Type 1, Type 2 and Type 3.",[16,65,66],{},"Let's take the user Lukas again. He sits at PC01 and opens a share on the file server SRV-FILE-01:",[16,68,69],{},[70,71],"img",{"alt":72,"src":73},"NTLM between client, server and domain controller: NEGOTIATE, CHALLENGE and AUTHENTICATE between client and server, then for a domain account the server asks the domain controller over Netlogon to check the response","\u002Fimages\u002Fposts\u002Fhow-ntlm-works-active-directory\u002Fntlm-handshake.svg",[75,76,78],"h3",{"id":77},"_1-negotiate-client-to-server","1. NEGOTIATE (client to server)",[16,80,81],{},"The client tells the server that it wants to authenticate with NTLM. The message contains a list of flags with the features the client supports, for example NTLMv2 and message signing. There is no username and no password in it yet.",[16,83,84],{},"The client only talks to the server. The domain controller doesn't know about this logon yet.",[75,86,88],{"id":87},"_2-challenge-server-to-client","2. CHALLENGE (server to client)",[16,90,91],{},"The server answers with a challenge. This is a randomly generated 8-byte number, sometimes called a nonce. Because every logon gets a new random number, an attacker can't simply replay a response they captured earlier.",[16,93,94],{},"The message also contains target information: the name of the server and its domain, and on newer systems a timestamp.",[75,96,98],{"id":97},"_3-authenticate-client-to-server","3. AUTHENTICATE (client to server)",[16,100,101],{},"Now the client sends the username, the domain, the name of its own computer and the response. The client calculates the response from the challenge and the NT hash of the password. How exactly depends on the NTLM version, more about this below.",[16,103,104],{},"Newer clients also add a MIC (Message Integrity Code). It's an HMAC over all three messages, so nobody in between can change the messages without the server noticing.",[16,106,107,108,112],{},"The password never crosses the network, and neither does the NT hash. Whoever has the NT hash can still calculate a valid response for any challenge without knowing the password. That's what a ",[20,109,111],{"href":110},"\u002Fp\u002Fexample-pass-the-hash-attack\u002F","pass-the-hash attack"," does.",[75,114,116],{"id":115},"_4-verification","4. Verification",[118,119,121],"h4",{"id":120},"local-authentication","Local Authentication",[16,123,124],{},"If the account is a local account on the server, the server takes the stored NT hash of the user from its local SAM (Security Account Manager) database. It calculates the response itself and compares it with the one from the client.",[118,126,128],{"id":127},"domain-based-authentication","Domain-Based Authentication",[16,130,131],{},"For a domain account the server can't check the response. It doesn't know the NT hash of the user, only the domain controller does. So the server forwards the username, the challenge and the response to a domain controller. This is called pass-through authentication.",[16,133,134],{},"The server uses the Netlogon secure channel for this, the connection that the computer account of the server has to its domain. The domain controller takes the NT hash of the user from the Active Directory database, calculates the expected response and compares it with the one from the client.",[16,136,137],{},"If they match, the domain controller tells the server that the logon is valid. It also sends the SID of the user, the groups and a session key. With this information the server builds the access token for Lukas, and he gets access to the share.",[16,139,140],{},"This has two consequences. Every NTLM logon to a domain account needs a domain controller, while with Kerberos the server checks the ticket itself. And if the server has a broken secure channel to its domain, NTLM logons of domain users fail on that server.",[11,142,144],{"id":143},"how-the-response-is-calculated","How the response is calculated",[75,146,148],{"id":147},"the-nt-hash","The NT hash",[16,150,151],{},"The NT hash is the MD4 hash of the password. MD4 is fast and there is no salt. The same password therefore always gives the same NT hash, on every machine and in every domain.",[75,153,155],{"id":154},"ntlmv1","NTLMv1",[16,157,158],{},"In NTLMv1 the client takes the 16 bytes of the NT hash, fills them up to 21 bytes and splits them into three DES keys with 7 bytes each. With each of these keys it encrypts the 8-byte challenge of the server. The three results together are the 24-byte response.",[16,160,161],{},"DES is old and the keys are short. Only the server adds randomness. And whoever captures an NTLMv1 response can recover the NT hash from it with a reasonable amount of effort. The NT hash is as good as the password.",[75,163,165],{"id":164},"ntlmv2","NTLMv2",[16,167,168],{},"NTLMv2 does this in two steps and adds a second source of randomness from the client:",[16,170,171],{},[70,172],{"alt":173,"src":174},"How the NTLMv2 response is made: NT hash, then the NTLMv2 hash from user name and domain, then the NTProofStr from the server challenge and a blob with timestamp, client challenge and target info","\u002Fimages\u002Fposts\u002Fhow-ntlm-works-active-directory\u002Fntlmv2-response.svg",[176,177,178,182,185],"ol",{},[179,180,181],"li",{},"The client calculates the NTLMv2 hash. This is an HMAC-MD5 with the NT hash as key, over the username in capitals and the domain name.",[179,183,184],{},"The client builds a blob. It contains a timestamp, 8 random bytes of its own (the client challenge) and the target information from the CHALLENGE message.",[179,186,187],{},"The client calculates the NTProofStr. This is an HMAC-MD5 with the NTLMv2 hash as key, over the server challenge and the blob.",[16,189,190],{},"The response is the NTProofStr followed by the blob. The server, or the domain controller, does the same calculation and compares the result.",[16,192,193],{},"NTLMv2 is a lot better than NTLMv1. But someone who captures a complete NTLMv2 handshake can still try passwords offline. With a weak password that doesn't take long.",[75,195,197],{"id":196},"ntlmv1-and-ntlmv2-compared","NTLMv1 and NTLMv2 compared",[199,200,201,214],"table",{},[202,203,204],"thead",{},[205,206,207,210,212],"tr",{},[208,209],"th",{},[208,211,155],{},[208,213,165],{},[215,216,217,229,240,251,262],"tbody",{},[205,218,219,223,226],{},[220,221,222],"td",{},"Algorithm",[220,224,225],{},"DES",[220,227,228],{},"HMAC-MD5",[205,230,231,234,237],{},[220,232,233],{},"Randomness",[220,235,236],{},"Server challenge only",[220,238,239],{},"Server and client challenge",[205,241,242,245,248],{},[220,243,244],{},"Timestamp in the response",[220,246,247],{},"No",[220,249,250],{},"Yes",[205,252,253,256,259],{},[220,254,255],{},"Captured response",[220,257,258],{},"NT hash can be recovered",[220,260,261],{},"Password can be guessed offline",[205,263,264,267,270],{},[220,265,266],{},"Status",[220,268,269],{},"Removed in Windows 11 24H2 and Server 2025",[220,271,272],{},"Deprecated",[16,274,275,276,280],{},"Which version a machine sends and accepts is controlled by the GPO setting \"Network security: LAN Manager authentication level\", in the registry ",[277,278,279],"code",{},"LmCompatibilityLevel",". Set it to \"Send NTLMv2 response only. Refuse LM & NTLM\" (level 5) on all machines, including the domain controllers. Then NTLMv1 is refused on both sides.",[11,282,284],{"id":283},"why-ntlm-is-a-problem","Why NTLM is a problem",[286,287,288,295,306,312,318],"ul",{},[179,289,290,294],{},[291,292,293],"strong",{},"The server is never authenticated."," The client proves who it is, the server doesn't. Kerberos authenticates both sides.",[179,296,297,300,301,305],{},[291,298,299],{},"Relay."," The client calculates a response for every challenge it gets. Someone who sits between client and server can pass the challenge of a real server to the client and its response back to that server. Then they are logged on there as the client. SMB signing, LDAP signing with channel binding and Extended Protection for Authentication (EPA) on web servers break this. More about LDAP in my article ",[20,302,304],{"href":303},"\u002Fp\u002Fldap-ldaps-and-active-directory\u002F","about LDAP, LDAPS and Active Directory",".",[179,307,308,311],{},[291,309,310],{},"Pass-the-hash."," The NT hash is enough to log on. Whoever gets it from the memory or the disk of a machine doesn't need the password anymore.",[179,313,314,317],{},[291,315,316],{},"Offline cracking."," NTLMv1 responses give away the NT hash, NTLMv2 responses can be used to guess the password.",[179,319,320,323],{},[291,321,322],{},"Old cryptography."," MD4, HMAC-MD5 and with NTLMv1 also DES.",[11,325,327],{"id":326},"when-windows-still-uses-ntlm","When Windows still uses NTLM",[16,329,330],{},"Applications normally don't ask for NTLM directly. They ask for Negotiate, and Negotiate tries Kerberos first. NTLM is the fallback when Kerberos doesn't work:",[16,332,333],{},[70,334],{"alt":335,"src":336},"When Windows falls back to NTLM: no name with an SPN, a local account or workgroup, or no domain controller reachable","\u002Fimages\u002Fposts\u002Fhow-ntlm-works-active-directory\u002Fntlm-fallback.svg",[16,338,339],{},"The most common reasons:",[286,341,342,349,352,355,358],{},[179,343,344,345,348],{},"An IP address instead of a name. Kerberos needs a Service Principal Name (SPN) for the target, and normally there is no SPN for an IP address. A script that maps ",[277,346,347],{},"\\\\10.0.0.5\\share"," uses NTLM.",[179,350,351],{},"A missing or duplicate SPN, for example when a service runs under a service account and nobody registered its SPN.",[179,353,354],{},"Local accounts and workgroups. There is no domain controller that could issue a Kerberos ticket.",[179,356,357],{},"No connection to a domain controller, for example because the VPN isn't up yet or the server is in a DMZ.",[179,359,360],{},"Some older applications and appliances ask for NTLM directly.",[16,362,363,364,305],{},"To find out who still uses NTLM in your domain, you first have to collect the NTLM audit events from all machines and put them together. I built a tool for that: ",[20,365,367],{"href":366},"\u002Fp\u002Fntlm-analyzer\u002F","NTLM-Analyzer",[11,369,371],{"id":370},"how-to-reduce-ntlm","How to reduce NTLM",[176,373,374,380,389,395,401,407,413],{},[179,375,376,379],{},[291,377,378],{},"Audit first."," Enable the \"Restrict NTLM: Audit\" policies on clients, servers and domain controllers. Event 4624 in the Security log also shows the NTLM version under \"Package Name (NTLM only)\".",[179,381,382,385,386,388],{},[291,383,384],{},"Switch off NTLMv1"," with ",[277,387,279],{}," 5.",[179,390,391,394],{},[291,392,393],{},"Fix the reasons for the fallback."," Names instead of IP addresses, correct SPNs.",[179,396,397,400],{},[291,398,399],{},"Protect against relay"," with SMB signing, LDAP signing and channel binding, and EPA.",[179,402,403,406],{},[291,404,405],{},"Put admins into the Protected Users group."," Members of this group can't authenticate with NTLM at all.",[179,408,409,412],{},[291,410,411],{},"Enable Credential Guard."," It protects the NT hashes in memory on the machine.",[179,414,415,418],{},[291,416,417],{},"Restrict NTLM step by step."," Clients and member servers first, domain controllers last.",[11,420,422],{"id":421},"where-microsoft-is-going","Where Microsoft is going",[286,424,425,434,437,446],{},[179,426,427,428,433],{},"In June 2024 Microsoft declared all versions of NTLM, including LANMAN, NTLMv1 and NTLMv2, as ",[20,429,432],{"href":430,"rel":431},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwhats-new\u002Fdeprecated-features",[36],"deprecated",". They are no longer under active feature development.",[179,435,436],{},"NTLMv1 has been removed in Windows 11 24H2 and Windows Server 2025.",[179,438,439,440,445],{},"From October 2026, Windows 11 24H2 and Server 2025 block NTLMv1-derived credentials for single sign-on by default (",[20,441,444],{"href":442,"rel":443},"https:\u002F\u002Fsupport.microsoft.com\u002Fhelp\u002F5066470",[36],"KB5066470","). This affects for example MS-CHAPv2 for Wi-Fi and VPN.",[179,447,448,449,454],{},"Microsoft has announced a ",[20,450,453],{"href":451,"rel":452},"https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-to-disable-ntlm-by-default-in-future-windows-releases",[36],"plan in three phases",". First better auditing, which is already available in Windows 11 24H2 and Server 2025. Then, in the second half of 2026, IAKerb and a local KDC, so Kerberos also works where NTLM was needed until now, for example for local accounts. And in the next major Windows Server release, network NTLM will be disabled by default.",[16,456,457],{},"Until then, the earlier you know where NTLM is still used in your domain, the less it hurts when Microsoft switches it off.",{"title":459,"searchDepth":460,"depth":460,"links":461},"",3,[462,464,465,475,481,482,483,484],{"id":13,"depth":463,"text":14},2,{"id":27,"depth":463,"text":28},{"id":53,"depth":463,"text":54,"children":466},[467,468,469,470],{"id":77,"depth":460,"text":78},{"id":87,"depth":460,"text":88},{"id":97,"depth":460,"text":98},{"id":115,"depth":460,"text":116,"children":471},[472,474],{"id":120,"depth":473,"text":121},4,{"id":127,"depth":473,"text":128},{"id":143,"depth":463,"text":144,"children":476},[477,478,479,480],{"id":147,"depth":460,"text":148},{"id":154,"depth":460,"text":155},{"id":164,"depth":460,"text":165},{"id":196,"depth":460,"text":197},{"id":283,"depth":463,"text":284},{"id":326,"depth":463,"text":327},{"id":370,"depth":463,"text":371},{"id":421,"depth":463,"text":422},"active-directory","2025-05-07","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.",false,"md","\u002Fimages\u002Fposts\u002Fhow-ntlm-works-active-directory\u002Fcover.webp",{},true,[494,495,496],"The three-message handshake","NTLMv1 vs NTLMv2","Why it has to go","\u002Fposts\u002Fhow-ntlm-works-active-directory",9,{"title":5,"description":487},"posts\u002Fhow-ntlm-works-active-directory","2",[503,485,504],"ntlm","authentication","2026-10-05","u8x9L7yXi6XnJZ4-ZGhdG5L_qU5JR9OwTosDnMjLDIc",[508,521,531,542,550,557,566,574,580,588,595,605,607,614,621,627,634,640,646,654,666,673,681,687,694,700,706,713,719,725,731,737,744,750,756,764,771,778],{"path":509,"title":510,"description":511,"date":512,"category":513,"alsoIn":514,"series":6,"tags":516,"readingTime":498},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[515],"windows",[515,517,518,519,520],"lsa","2fa","credential-provider","security",{"path":522,"title":523,"description":524,"date":525,"category":515,"alsoIn":526,"series":527,"tags":528,"readingTime":530},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[513],"Doppio · 3-part series",[515,517,503,529,518,520],"smb",35,{"path":532,"title":533,"description":534,"date":535,"category":513,"alsoIn":6,"series":6,"tags":536,"readingTime":541},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[485,537,538,539,503,540],"windows-server","powershell","hardening","kerberos",5,{"path":543,"title":544,"description":545,"date":546,"category":513,"alsoIn":6,"series":6,"tags":547,"readingTime":549},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[485,503,540,548,537],"auditing",6,{"path":551,"title":552,"description":553,"date":554,"category":515,"alsoIn":6,"series":527,"tags":555,"readingTime":556},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[515,519,517,518,520],32,{"path":558,"title":559,"description":560,"date":561,"category":515,"alsoIn":562,"series":527,"tags":563,"readingTime":565},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[513],[515,519,518,564,520],"totp",60,{"path":567,"title":568,"description":569,"date":570,"category":513,"alsoIn":6,"series":6,"tags":571,"readingTime":460},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[485,537,538,572,573],"tiering","laps",{"path":575,"title":576,"description":577,"date":570,"category":485,"alsoIn":6,"series":6,"tags":578,"readingTime":579},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":581,"title":582,"description":583,"date":584,"category":585,"alsoIn":6,"series":6,"tags":586,"readingTime":460},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[587],"tor",{"path":589,"title":590,"description":591,"date":592,"category":485,"alsoIn":6,"series":6,"tags":593,"readingTime":594},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[540],1,{"path":596,"title":597,"description":598,"date":599,"category":600,"alsoIn":6,"series":6,"tags":601,"readingTime":604},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[600,602,603],"exchange-se","exchange-2019",47,{"path":497,"title":5,"description":487,"date":486,"category":485,"alsoIn":6,"series":6,"tags":606,"readingTime":498},[503,485,504],{"path":608,"title":609,"description":610,"date":611,"category":485,"alsoIn":6,"series":6,"tags":612,"readingTime":473},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[613],"adfs",{"path":615,"title":616,"description":617,"date":618,"category":485,"alsoIn":6,"series":6,"tags":619,"readingTime":460},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[620],"pass-the-hash",{"path":622,"title":623,"description":624,"date":625,"category":485,"alsoIn":6,"series":6,"tags":626,"readingTime":549},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[540],{"path":628,"title":629,"description":630,"date":631,"category":515,"alsoIn":6,"series":6,"tags":632,"readingTime":460},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[633],"credential-guard",{"path":635,"title":636,"description":637,"date":638,"category":515,"alsoIn":6,"series":6,"tags":639,"readingTime":473},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[633],{"path":641,"title":642,"description":643,"date":638,"category":515,"alsoIn":6,"series":6,"tags":644,"readingTime":460},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[645],"osconfig",{"path":647,"title":648,"description":649,"date":650,"category":515,"alsoIn":6,"series":6,"tags":651,"readingTime":460},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[652,653],"iis","modsecurity",{"path":655,"title":656,"description":657,"date":658,"category":485,"alsoIn":6,"series":6,"tags":659,"readingTime":665},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[660,661,662,663,664],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":667,"title":668,"description":669,"date":670,"category":485,"alsoIn":6,"series":6,"tags":671,"readingTime":672},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[660,661],36,{"path":674,"title":675,"description":676,"date":677,"category":678,"alsoIn":6,"series":6,"tags":679,"readingTime":665},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[680,515,485],"writeup",{"path":682,"title":683,"description":684,"date":685,"category":485,"alsoIn":6,"series":6,"tags":686,"readingTime":463},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":688,"title":689,"description":690,"date":691,"category":678,"alsoIn":6,"series":6,"tags":692,"readingTime":693},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[680,585],12,{"path":695,"title":696,"description":697,"date":698,"category":678,"alsoIn":6,"series":6,"tags":699,"readingTime":498},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[680,585],{"path":701,"title":702,"description":703,"date":704,"category":678,"alsoIn":6,"series":6,"tags":705,"readingTime":594},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[680,515,485],{"path":707,"title":708,"description":709,"date":710,"category":678,"alsoIn":6,"series":6,"tags":711,"readingTime":712},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[680,585],7,{"path":714,"title":715,"description":716,"date":717,"category":678,"alsoIn":6,"series":6,"tags":718,"readingTime":460},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[680,585],{"path":720,"title":721,"description":722,"date":723,"category":678,"alsoIn":6,"series":6,"tags":724,"readingTime":594},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[680,585],{"path":726,"title":727,"description":728,"date":729,"category":678,"alsoIn":6,"series":6,"tags":730,"readingTime":460},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[680,585],{"path":732,"title":733,"description":734,"date":735,"category":678,"alsoIn":6,"series":6,"tags":736,"readingTime":473},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[680,585],{"path":738,"title":739,"description":740,"date":741,"category":678,"alsoIn":6,"series":6,"tags":742,"readingTime":541},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[680,743],"freebsd",{"path":745,"title":746,"description":747,"date":748,"category":678,"alsoIn":6,"series":6,"tags":749,"readingTime":579},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[680,515],{"path":751,"title":752,"description":753,"date":754,"category":678,"alsoIn":6,"series":6,"tags":755,"readingTime":460},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[680,515],{"path":757,"title":758,"description":759,"date":760,"category":585,"alsoIn":6,"series":6,"tags":761,"readingTime":594},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[762,763],"ssh","monitoring",{"path":765,"title":766,"description":767,"date":768,"category":678,"alsoIn":6,"series":6,"tags":769,"readingTime":770},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[680,515,485],16,{"path":772,"title":773,"description":774,"date":775,"category":600,"alsoIn":6,"series":6,"tags":776,"readingTime":594},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[777,538],"m365",{"path":779,"title":780,"description":781,"date":782,"category":600,"alsoIn":6,"series":6,"tags":783,"readingTime":594},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195052541]