[{"data":1,"prerenderedAt":786},["ShallowReactive",2],{"post-secure-iis-modsecurity":3,"post-list":507},{"id":4,"title":5,"alsoIn":6,"body":7,"category":491,"date":492,"description":493,"draft":494,"extension":495,"image":496,"links":6,"meta":497,"navigation":498,"order":6,"path":499,"readingTime":482,"seo":500,"series":6,"stem":501,"strength":502,"tags":503,"unlisted":494,"updated":6,"__hash__":506},"posts\u002Fposts\u002Fsecure-iis-modsecurity.md","Secure IIS with Modsecurity",null,{"type":8,"value":9,"toc":481},"minimark",[10,15,19,23,26,35,42,45,50,53,58,61,66,69,74,77,82,85,90,93,98,102,105,110,113,118,122,125,131,136,139,149,152,157,160,165,168,174,177,182,185,190,193,199,202,207,210,215,218,223,226,231,234,238,241,246,249,254,256,261,264,269,271,276,279,284,287,292,295,300,303,308,311,316,319,324,327,332,335,340,343,348,351,356,359,364,367,372,375,380,383,385,390,393,398,402,405,408,413,416,421,425,428,433,436,441,444,449,452,458,460,465,468,473,476],[11,12,14],"h2",{"id":13},"foreword","Foreword",[16,17,18],"p",{},"In this guide I will show you how to configure Modsecurity for the IIS webserver with the OWASP rules.",[11,20,22],{"id":21},"download-modsecurity","Download Modsecurity",[16,24,25],{},"Download Modsecurity from the official Github page. The latest version for Windows is v2.9.7 at the moment. Just download the MSI-File.",[16,27,28,29],{},"Link: ",[30,31,32],"a",{"href":32,"rel":33},"https:\u002F\u002Fgithub.com\u002Fowasp-modsecurity\u002FModSecurity\u002Freleases\u002Ftag\u002Fv2.9.7",[34],"nofollow",[16,36,37],{},[38,39],"img",{"alt":40,"src":41},"","\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F1.webp",[16,43,44],{},"You should now have the downloaded file.",[16,46,47],{},[38,48],{"alt":40,"src":49},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F2.webp",[16,51,52],{},"Double click to install it and follow the setup. Click on next.",[16,54,55],{},[38,56],{"alt":40,"src":57},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F3.webp",[16,59,60],{},"Accept the terms and click on next.",[16,62,63],{},[38,64],{"alt":40,"src":65},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F4.webp",[16,67,68],{},"Just click on next again.",[16,70,71],{},[38,72],{"alt":40,"src":73},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F5.webp",[16,75,76],{},"Make sure that the option \"Perform ModSecurityIIS configuration.\" is selected (should be default).",[16,78,79],{},[38,80],{"alt":40,"src":81},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F6.webp",[16,83,84],{},"Click on install.",[16,86,87],{},[38,88],{"alt":40,"src":89},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F7.webp",[16,91,92],{},"Click on finish.",[16,94,95],{},[38,96],{"alt":40,"src":97},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F8.webp",[11,99,101],{"id":100},"confirm-installation","Confirm installation",[16,103,104],{},"Open the IIS Manager on your IIS server.",[16,106,107],{},[38,108],{"alt":40,"src":109},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F9.webp",[16,111,112],{},"Select the \"Modules\" option. You should see entries for \"ModSecurity\" like in the screenshot below.",[16,114,115],{},[38,116],{"alt":40,"src":117},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F10.webp",[11,119,121],{"id":120},"download-owasp-rules","Download OWASP rules",[16,123,124],{},"Download the OWASP core ruleset from the official Github page. Just download the minimal ZIP-File.",[16,126,28,127],{},[30,128,129],{"href":129,"rel":130},"https:\u002F\u002Fgithub.com\u002Fcoreruleset\u002Fcoreruleset\u002Freleases\u002Ftag\u002Fv4.10.0",[34],[16,132,133],{},[38,134],{"alt":40,"src":135},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F12.webp",[16,137,138],{},"Navigate to the following path:",[140,141,146],"pre",{"className":142,"code":144,"language":145,"meta":40},[143],"language-text","C:\\Program Files\\ModSecurity IIS\n","text",[147,148,144],"code",{"__ignoreMap":40},[16,150,151],{},"Find the \"modsecurity.conf\" file.",[16,153,154],{},[38,155],{"alt":40,"src":156},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F13.webp",[16,158,159],{},"Open the file with the editor of your choice.",[16,161,162],{},[38,163],{"alt":40,"src":164},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F14.webp",[16,166,167],{},"Change the line \"SecRuleEngine\" to enable it.",[140,169,172],{"className":170,"code":171,"language":145,"meta":40},[143],"SecRuleEngine On\n",[147,173,171],{"__ignoreMap":40},[16,175,176],{},"It should look like this.",[16,178,179],{},[38,180],{"alt":40,"src":181},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F15.webp",[16,183,184],{},"Now find the \"modsecurity_iis.conf\" file.",[16,186,187],{},[38,188],{"alt":40,"src":189},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F16.webp",[16,191,192],{},"Open the file with the editor of your choice and add the following lines:",[140,194,197],{"className":195,"code":196,"language":145,"meta":40},[143],"Include crs-setup.conf\nInclude rules\u002F*.conf\n",[147,198,196],{"__ignoreMap":40},[16,200,201],{},"It should look like this:",[16,203,204],{},[38,205],{"alt":40,"src":206},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F17.webp",[16,208,209],{},"Open the extracted core ruleset folder and search the file \"crs-setup.conf.example\".",[16,211,212],{},[38,213],{"alt":40,"src":214},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F18.webp",[16,216,217],{},"Copy the file to the \"ModSecurity IIS\" folder.",[16,219,220],{},[38,221],{"alt":40,"src":222},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F19.webp",[16,224,225],{},"Remove the \".example\" file type. It should look like this.",[16,227,228],{},[38,229],{"alt":40,"src":230},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F21.webp",[16,232,233],{},"Open the extracted core ruleset folder and search the \"rules\" folder.",[16,235,236],{},[38,237],{"alt":40,"src":214},[16,239,240],{},"Copy the \"rules\" folder to the \"ModSecurity IIS\" folder. It should look like this.",[16,242,243],{},[38,244],{"alt":40,"src":245},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F22.webp",[16,247,248],{},"Now go into the \"rules\" folder and search the \"RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example\" file.",[16,250,251],{},[38,252],{"alt":40,"src":253},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F23.webp",[16,255,225],{},[16,257,258],{},[38,259],{"alt":40,"src":260},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F25.webp",[16,262,263],{},"In the C:\\ directory, create a new folder with the name \"Modsecurity-Logs\".",[16,265,266],{},[38,267],{"alt":40,"src":268},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F28.webp",[16,270,176],{},[16,272,273],{},[38,274],{"alt":40,"src":275},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F29.webp",[16,277,278],{},"Do a right-click on the new folder and select \"Properties\".",[16,280,281],{},[38,282],{"alt":40,"src":283},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F30.webp",[16,285,286],{},"The following window appears.",[16,288,289],{},[38,290],{"alt":40,"src":291},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F31.webp",[16,293,294],{},"Navigate to the \"Security\" tab and click on \"Edit...\".",[16,296,297],{},[38,298],{"alt":40,"src":299},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F32.webp",[16,301,302],{},"The following window appears. Click on \"Add...\".",[16,304,305],{},[38,306],{"alt":40,"src":307},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F33.webp",[16,309,310],{},"You should see the following window. Click on \"Locations...\".",[16,312,313],{},[38,314],{"alt":40,"src":315},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F34.webp",[16,317,318],{},"Select your IIS server.",[16,320,321],{},[38,322],{"alt":40,"src":323},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F35.webp",[16,325,326],{},"Select the \"IIS_IUSRS\" group.",[16,328,329],{},[38,330],{"alt":40,"src":331},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F36.webp",[16,333,334],{},"Make sure that you give the \"IIS_IUSRS\" modify permissions. It should look like in the screenshot.",[16,336,337],{},[38,338],{"alt":40,"src":339},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F37.webp",[16,341,342],{},"In the new \"Modsecurity-Logs\" folder, create a new Text Document.",[16,344,345],{},[38,346],{"alt":40,"src":347},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F38.webp",[16,349,350],{},"Change the name of the file to \"modsec_audit.log\" and accept the warning cause of the file name extensions change.",[16,352,353],{},[38,354],{"alt":40,"src":355},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F39.webp",[16,357,358],{},"It should look like this in the end.",[16,360,361],{},[38,362],{"alt":40,"src":363},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F40.webp",[16,365,366],{},"Navigate to the \"ModSecurity IIS\" path and open the \"modsecurity.conf\" file again.",[140,368,370],{"className":369,"code":144,"language":145,"meta":40},[143],[147,371,144],{"__ignoreMap":40},[16,373,374],{},"Scroll down until you find the \"SecAuditLogType\" option.",[16,376,377],{},[38,378],{"alt":40,"src":379},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F41.webp",[16,381,382],{},"Remove the \"#\" symbol at the \"SecAuditLog\" option and change the path to \"C:\\Modsecurity-Logs\\modsec_audit.log\".",[16,384,176],{},[16,386,387],{},[38,388],{"alt":40,"src":389},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F42.webp",[16,391,392],{},"Restart the IIS after that.",[16,394,395],{},[38,396],{"alt":40,"src":397},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F43.webp",[11,399,401],{"id":400},"test","Test",[16,403,404],{},"To confirm that Modsecurity works we can do a little test.",[16,406,407],{},"From an external client, enter the published Domain of the your IIS and enter \u002Fetc\u002Fpasswd\u002F as the path. We should get a 404 error.",[16,409,410],{},[38,411],{"alt":40,"src":412},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F44.webp",[16,414,415],{},"We should now see an entry for this in the “modsec_audit.log” file. Modsecurity has now been successfully tested.",[16,417,418],{},[38,419],{"alt":40,"src":420},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F45.webp",[11,422,424],{"id":423},"fix-pki-certenroll","Fix PKI (CertEnroll)",[16,426,427],{},"If you operate a PKI, it is very likely that access to the \u002FCertEnroll directory will no longer work.\nThere are entries in the log that could look something like the ones below.",[16,429,430],{},[38,431],{"alt":40,"src":432},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_6.webp",[16,434,435],{},"If you try to access the \u002FCertEnroll folder you probably get an access denied or blank page.",[16,437,438],{},[38,439],{"alt":40,"src":440},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_2.webp",[16,442,443],{},"Navigate to the C:\\Program Files\\ModSecurity IIS\\rules folder and search the \"REQUEST-920-PROTOCOL-ENFORCEMENT.conf\".",[16,445,446],{},[38,447],{"alt":40,"src":448},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_1.webp",[16,450,451],{},"Scroll at the bottom of the file and insert the following lines:",[140,453,456],{"className":454,"code":455,"language":145,"meta":40},[143],"# Allow CertEnroll and OCSP\nSecRule REQUEST_URI \"@beginsWith \u002FCertEnroll\" \"id:920350,phase:1,log,allow,ctl\"\nSecRule REQUEST_URI \"@beginsWith \u002Focsp\" \"id:920350,phase:1,log,allow,ctl\"\n",[147,457,455],{"__ignoreMap":40},[16,459,176],{},[16,461,462],{},[38,463],{"alt":40,"src":464},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_3.webp",[16,466,467],{},"Restart the IIS after the change.",[16,469,470],{},[38,471],{"alt":40,"src":472},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_4.webp",[16,474,475],{},"The access should work again after the restart.",[16,477,478],{},[38,479],{"alt":40,"src":480},"\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fattachments\u002F_5.webp",{"title":40,"searchDepth":482,"depth":482,"links":483},3,[484,486,487,488,489,490],{"id":13,"depth":485,"text":14},2,{"id":21,"depth":485,"text":22},{"id":100,"depth":485,"text":101},{"id":120,"depth":485,"text":121},{"id":400,"depth":485,"text":401},{"id":423,"depth":485,"text":424},"windows","2025-01-12","Installation guide to secure IIS with Modsecurity",false,"md","\u002Fimages\u002Fposts\u002Fsecure-iis-modsecurity\u002Fcover.webp",{},true,"\u002Fposts\u002Fsecure-iis-modsecurity",{"title":5,"description":493},"posts\u002Fsecure-iis-modsecurity","2",[504,505],"iis","modsecurity","GpuUPI4A-fXmwV1OzpdxDE-LxcLTjVfckovQ2MTfFlU",[508,521,532,544,552,559,568,576,582,590,597,607,614,622,629,635,642,648,654,656,668,675,683,689,696,702,708,715,721,727,733,739,746,752,758,766,773,780],{"path":509,"title":510,"description":511,"date":512,"category":513,"alsoIn":514,"series":6,"tags":515,"readingTime":520},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[491],[491,516,517,518,519],"lsa","2fa","credential-provider","security",9,{"path":522,"title":523,"description":524,"date":525,"category":491,"alsoIn":526,"series":527,"tags":528,"readingTime":531},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[513],"Doppio · 3-part series",[491,516,529,530,517,519],"ntlm","smb",35,{"path":533,"title":534,"description":535,"date":536,"category":513,"alsoIn":6,"series":6,"tags":537,"readingTime":543},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[538,539,540,541,529,542],"active-directory","windows-server","powershell","hardening","kerberos",5,{"path":545,"title":546,"description":547,"date":548,"category":513,"alsoIn":6,"series":6,"tags":549,"readingTime":551},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[538,529,542,550,539],"auditing",6,{"path":553,"title":554,"description":555,"date":556,"category":491,"alsoIn":6,"series":527,"tags":557,"readingTime":558},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[491,518,516,517,519],32,{"path":560,"title":561,"description":562,"date":563,"category":491,"alsoIn":564,"series":527,"tags":565,"readingTime":567},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[513],[491,518,517,566,519],"totp",60,{"path":569,"title":570,"description":571,"date":572,"category":513,"alsoIn":6,"series":6,"tags":573,"readingTime":482},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[538,539,540,574,575],"tiering","laps",{"path":577,"title":578,"description":579,"date":572,"category":538,"alsoIn":6,"series":6,"tags":580,"readingTime":581},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":583,"title":584,"description":585,"date":586,"category":587,"alsoIn":6,"series":6,"tags":588,"readingTime":482},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[589],"tor",{"path":591,"title":592,"description":593,"date":594,"category":538,"alsoIn":6,"series":6,"tags":595,"readingTime":596},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[542],1,{"path":598,"title":599,"description":600,"date":601,"category":602,"alsoIn":6,"series":6,"tags":603,"readingTime":606},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[602,604,605],"exchange-se","exchange-2019",47,{"path":608,"title":609,"description":610,"date":611,"category":538,"alsoIn":6,"series":6,"tags":612,"readingTime":520},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[529,538,613],"authentication",{"path":615,"title":616,"description":617,"date":618,"category":538,"alsoIn":6,"series":6,"tags":619,"readingTime":621},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[620],"adfs",4,{"path":623,"title":624,"description":625,"date":626,"category":538,"alsoIn":6,"series":6,"tags":627,"readingTime":482},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[628],"pass-the-hash",{"path":630,"title":631,"description":632,"date":633,"category":538,"alsoIn":6,"series":6,"tags":634,"readingTime":551},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[542],{"path":636,"title":637,"description":638,"date":639,"category":491,"alsoIn":6,"series":6,"tags":640,"readingTime":482},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[641],"credential-guard",{"path":643,"title":644,"description":645,"date":646,"category":491,"alsoIn":6,"series":6,"tags":647,"readingTime":621},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[641],{"path":649,"title":650,"description":651,"date":646,"category":491,"alsoIn":6,"series":6,"tags":652,"readingTime":482},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[653],"osconfig",{"path":499,"title":5,"description":493,"date":492,"category":491,"alsoIn":6,"series":6,"tags":655,"readingTime":482},[504,505],{"path":657,"title":658,"description":659,"date":660,"category":538,"alsoIn":6,"series":6,"tags":661,"readingTime":667},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[662,663,664,665,666],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":669,"title":670,"description":671,"date":672,"category":538,"alsoIn":6,"series":6,"tags":673,"readingTime":674},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[662,663],36,{"path":676,"title":677,"description":678,"date":679,"category":680,"alsoIn":6,"series":6,"tags":681,"readingTime":667},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[682,491,538],"writeup",{"path":684,"title":685,"description":686,"date":687,"category":538,"alsoIn":6,"series":6,"tags":688,"readingTime":485},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":690,"title":691,"description":692,"date":693,"category":680,"alsoIn":6,"series":6,"tags":694,"readingTime":695},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[682,587],12,{"path":697,"title":698,"description":699,"date":700,"category":680,"alsoIn":6,"series":6,"tags":701,"readingTime":520},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[682,587],{"path":703,"title":704,"description":705,"date":706,"category":680,"alsoIn":6,"series":6,"tags":707,"readingTime":596},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[682,491,538],{"path":709,"title":710,"description":711,"date":712,"category":680,"alsoIn":6,"series":6,"tags":713,"readingTime":714},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[682,587],7,{"path":716,"title":717,"description":718,"date":719,"category":680,"alsoIn":6,"series":6,"tags":720,"readingTime":482},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[682,587],{"path":722,"title":723,"description":724,"date":725,"category":680,"alsoIn":6,"series":6,"tags":726,"readingTime":596},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[682,587],{"path":728,"title":729,"description":730,"date":731,"category":680,"alsoIn":6,"series":6,"tags":732,"readingTime":482},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[682,587],{"path":734,"title":735,"description":736,"date":737,"category":680,"alsoIn":6,"series":6,"tags":738,"readingTime":621},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[682,587],{"path":740,"title":741,"description":742,"date":743,"category":680,"alsoIn":6,"series":6,"tags":744,"readingTime":543},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[682,745],"freebsd",{"path":747,"title":748,"description":749,"date":750,"category":680,"alsoIn":6,"series":6,"tags":751,"readingTime":581},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[682,491],{"path":753,"title":754,"description":755,"date":756,"category":680,"alsoIn":6,"series":6,"tags":757,"readingTime":482},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[682,491],{"path":759,"title":760,"description":761,"date":762,"category":587,"alsoIn":6,"series":6,"tags":763,"readingTime":596},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[764,765],"ssh","monitoring",{"path":767,"title":768,"description":769,"date":770,"category":680,"alsoIn":6,"series":6,"tags":771,"readingTime":772},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[682,491,538],16,{"path":774,"title":775,"description":776,"date":777,"category":602,"alsoIn":6,"series":6,"tags":778,"readingTime":596},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[779,540],"m365",{"path":781,"title":782,"description":783,"date":784,"category":602,"alsoIn":6,"series":6,"tags":785,"readingTime":596},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195054449]