Account Management and Password Controls

11 Ensure that all users are created at the domain level and clearly annotated in the active directory. Each user should trace to a specific employee or team.

Most user accounts should be administered centrally by a domain controller, with the possible exception of accounts created on isolated systems that are not a member of a domain (e.g., some DMZs). This increases network security because account provisioning and deprovisioning can be controlled.

How

You can view the accounts by opening compmgmt.msc from the command line or with DumpSec using the following syntax:

DumpSec.exe /rpt=users /saveas=fixed /outfile=users.txt

Discuss your findings with the administrator, and pay close attention to accounts that should exist outside the domain. The only accounts that should exist outside the domain are the built-in guest and administrator accounts unless required by an application.

12 Review and evaluate the use of groups, and determine the restrictiveness of their use.

Groups can greatly simplify the provisioning and deprovisioning process for adding or removing user access to systems as users join and leave a team. However, old members sometimes hang around inside a group when they leave a team.

How

Review the contents of the groups on the system for appropriate membership while you're looking through the accounts using the method in the preceding step. Remember, in an active directory environment, groups can be nested, and you need to check the membership of the nested groups. In general, this is a good time to investigate the use of shared accounts. Such accounts present risk in that you loose accountability for actions taken on the system. However, there are certain situations in which this is unavoidable, such as with certain software on a manufacturing floor. Organizations dealing with PCI or HIPAA should examine their use of shared accounts closely.

Additionally, ensure that the IT security team, investigations team, and appropriate support personnel have administrative access to the server. This may not pertain to all organizations, and there may be some exceptions. These should be placed into a group and not added as individual users to the server.

13 Review and evaluate the strength of system passwords.

If passwords on the system are easy to guess, it is more likely that an attacker will be able to break into that account, obtaining unauthorized access to the system and its resources. A key mitigating control for many organizations is the use of two-factor authentication.

How

All accounts should have passwords. The methods used to test these controls depend on the password-provisioning process and controls enabled on the servers and active directory. At a minimum, you should review system settings that provide password controls such as those mentioned in the next step.

There are several ways to retrieve and test Windows password hashes. However, be careful and play it safe. Password dump, or pwdump, is one commonly used tool to dump password hashes from systems (download information below). It works well, and you should take a look at it. However, even the latest version may have problems on your server, crashing your system. This has happened to organizations that tweaked the internals of the server. Test everything in a nonproduction environment first!

Perhaps the easiest way to get your SAM and SYSTEM files is to copy them from the C:\WINDOWS\repair directory. Select the files with the CTRL key pressed, and then drag them to another folder or USB drive with the CTRL key still pressed.

As for cracking the passwords, once you have the hashes, you can attempt cracking the passwords with one of the password crackers listed un Table 6-4. Several of them also will take the SAM and SYSTEM files as direct inputs, dump the hashes, and perform the crack.

14 Evaluate the use of password controls on the server, such as password aging, length, complexity, history, and lockout policies.

Password controls are essential to enforcing password complexity, length, age, and other factors that keep unauthorized users out of a system.

How

you'll find the account policies as they affect your system by typing rsop.msc at the command line. When the window opens, select Computer Configuration Windows Settings Account Policies. In general, verify that the policies listed in Table 6-5 are set in accordance with your local policies. Some common settings have been listed.